PaperClipAI/doc/plans/2026-10-06-default-agent-runner.md

# Runner defaults: staged delivery

## Current qualification and repair checkpoint — 2026-10-13

Canonical branch: `codex/codex-runner-default`. Delivery:
[#15683](https://github.com/paperclipai/paperclip/pull/15683).
The published baseline `ea6c8eb5e16d61111968f633a66748b397b64a3e` has
53 successful hosted checks, two conditional Storybook skips, required verify
and E2E passes, fresh 5/5 review and 30 resolved threads. Its
[package qualification](https://github.com/paperclipai/paperclip/actions/runs/38478290686)
passes all four native producers and clean Apple Silicon, Intel Mac and Linux
ARM64 consumers. All 18 package source manifests and binary hashes match; no
Codex payload is bundled. The isolated Apple Silicon install and zero-turn native
startup pass, and fresh installed JavaScript applies all 342 migrations through
0343 with confirmed owned cleanup. These are literal baseline results, not proof
of the new repairs. Linux remains GNU libc 2.39 or newer on x64/AArch64; Windows,
Alpine and 32-bit ARM stay deferred. No warm-cache speedup or paid ARM task is
claimed. Docker, Cargo and native builds remain remote.

The [single baseline managed attempt](https://github.com/paperclipai/paperclip/actions/runs/38478333712)
fails completion reporting and the physical child-file assertion; its
[existing report](https://d1p6rlowie26tp.cloudfront.net/runner-e2e/campaigns/gha-38478333712-1/index.html)
remains red. Two runs execute provider turns. A third callback is falsely marked
successful during startup, before any provider turn, because its onboarding
parent is already Done. One unstarted child wake is cancelled. Recovery now
reuses the existing completed-onboarding handoff validator before applying the
issue-terminal backstop. Company, parent origin/status, assignee, completed child
and remaining children must match. Process-death and ownership checks remain.
Three reproduced baseline failures become 103 passing PostgreSQL controls across
the existing recovery suites, with canonical server typecheck passing. Owned
test clusters stop and release their slot. The native file tool correctly remains
bound to its current task: the original run saved a child document but attached
the file to the parent. First-task instructions now send file-producing work
through the child's own execution, dependency and block handoff, then verify and
link the child's result. Document-only and plan-only paths retain their scope.
Two reproduced instruction-contract failures become 15 passing existing asset
and greeting controls; these static checks do not prove model compliance.

All seven baseline managed lease rows are released or expired with successful
cleanup records, and prior company environment settings are restored. A separate
owned-server supervisor reports incomplete descendant cleanup after server exit;
its missing nested cause remains unresolved. Lease records do not prove physical
deletion or settle unknown charges. Existing cost and cleanup holds remain.
Revised-source live acceptance must still check actual turn events, the child's
downloaded physical file, source-correlated completion, follow-up and continuity.
Do not rerun the known failing baseline or weaken its assertions.

The normal staging preparation and exact baseline Core image build complete, but
the deployment check rejects `fleet_campaign_staging_requires_master`. Current
Cloud policy admits only actual master source ancestry, including preview DB
artifacts; a pinned, owned single target has no exception. No staging campaign
starts and no serving-candidate claim is made. A human sequencing decision is
pending: complete Mac and signed managed acceptance before a normal squash,
then qualify the actual merged revision on the owned staging stack, or use a
separate branch-friendly test environment before merge. Do not bypass this gate
or change merge method to preserve preview ancestry. The preview Core image has
verified content identity but no verified signature; the managed image signature
is separately verified. Actual private Cloud composition and fresh warm/cold
signup remain required production-readiness evidence after merge.

Next action: independent matching-source review, affected map checks and publish
the two scoped repairs in one source commit. Freeze that head, require fresh full
CI and 5/5 review, then repeat the existing package/install and single managed
journeys on admitted artifacts. Upgrade the idle local app with full saved
configuration, account and recorded-run-profile comparisons; preserve its data.
Use a fresh ordinary installed instance for automatic first-agent task/follow-up.
The new $100 QA ceiling permits bounded messages with paid concurrency one and
180-second runs; prior unknown-charge and cleanup holds remain separate.
Existing runners never migrate. Normal protected merge is authorized once
applicable gates and the sequencing decision are satisfied. No production or
provisioning-default promotion, local heavy build, new timer or archive is
authorized. Earlier checkpoints below retain their historical source attribution.

## Current Codex merge checkpoint — 2026-10-13

Current published `1173a859baa78af1d382058aa89c25920da25c3d` passes
the policy, selector and commitperclip gates and is mergeable; full checks and
fresh review remain incomplete. Two reviewed setup findings have treatments:
missing forced-Kubernetes environments stay unqualified sandbox targets, so
automatic Codex creation preserves Legacy without provisioning and explicit
native selection returns qualification guidance. Four baseline failures become
161 passing existing selection/environment controls. Local daemon resolution now
precedes credential staging; preparation errors remove only the owned pre-handoff
root, while unconfirmed probe retirement retains recovery state. Three original
filesystem failures become 96 passing setup controls. Fake credentials and service
controls do not qualify live Kubernetes or provider execution. Matching final
source review, maps and typecheck are required before publishing the fixes.

Published `2902b72c330d37ddff5d59e07927716dc3e1517c` is blocked before
main CI by the repository's tracked-lock policy and another master conflict.
The generated dependency lock is retained as build evidence; the branch restores
master's exact tracked lock, using the existing scripts-disabled CI resolution
path instead of bypassing the gate. Normal reconciliation with
`e0f30a4c7186498b71b2637f253b3399997dac7d` preserves controller-loss
attribution, creator identity and migration 0343, voice qualification and Apps
connection controls. Both test conflicts retain the Codex runner checks and
incoming controls. All 45 built-in and 44 controller/run-state controls pass;
maps and token gates remain clean. This source requires fresh CI/review and
appropriate installed/live qualification. Cancellation is requested for the
obsolete 2902 managed workflow before a paid test job is observed; terminal cancellation and unknown
remote costs still need confirmation. No unchanged paid test is retried.

Independent inspection verifies the literal 578 fresh Mac journey below: exactly
one child, one document revised from one to two, and the same workspace file
changed from Saturday to Sunday with both required markers. Five executed runs
succeed with no interval overlap; one terminal-child wake is cancelled before
starting. Parent session continuity and the separate child session in the same
workspace are recorded. Estimated run cost is $1.820721600; setup usage and
settlement remain unknown. Reload preserves the completed task and revision.
This manual evidence does not relabel the original managed failure or newer source.

The reviewed fixture changes are published as
`8d65fd7fc31d8170082f30a314b87c4779f91e8a`. Before a main CI merge checkout
is created, master advances to `edcfcaf3f69abfda12fcbc63225f7346f53450aa`.
Normal reconciliation retains its repository-skill preparation, signed idle wake
deadlines, readiness errors, voice support and migrations 0341/0342. The sole
text conflict preserves master's cancelled-lock return semantics and the PR's
bounded error-code diagnostic. The dependency lock is completed for the existing
server test dependencies and incoming voice dependency, without changing prior
resolved versions or running install hooks. Frozen-lock validation, 29 existing
native-authority/runtime-skill controls, E2E no-emit, maps and token gates pass.
This combined server/UI/DB source requires new package and live qualification;
literal 578 results below remain attributed to their actual source.

The separate fresh Mac UI journey on installed 578 selects automatic native Codex,
connects an API-key account, creates the first agent, and reaches the ordinary
opening card. Accepting its proposal creates exactly one child task with a saved
document and workspace file. A follow-up changes that existing document to
revision two and edits the same file. Independent content, recorded execution,
workspace, session-boundary and accounting inspection remains in progress.
The failed managed eval is retained separately; this manual journey does not
turn its failed oracle green. All paid work remains bounded by the new $100
allowance, 180-second runs and single-provider concurrency, with prior holds kept.

Canonical branch: `codex/codex-runner-default`. Delivery PR:
[#15683](https://github.com/paperclipai/paperclip/pull/15683).
The runtime/install prerequisite #16028 and release repair #16149 are merged.
The finish line remains ordinary native Codex onboarding, checked task/follow-up,
saved-agent preservation, exact-candidate installation and required checks, then
a normal protected merge. Production deployment and default promotion remain
outside this merge campaign.

Reconciled head `d68f1facf0e174a4f8a771a2055e02c72a47c289` receives a fresh
5/5 review with all 28 threads resolved. Its required E2E check passes, but the
aggregate verification check fails two test shards. A retained company fixture
collides because it truncates random UUIDs to six characters; full-UUID seed
treatment passes 255 existing PostgreSQL controls with zero skips. The existing
Runner durable-progress case lacks the diagnostic evidence needed to identify
its failure. Bounded failure diagnostics retain the original error, all deadlines,
usage, recovery and deduplication assertions. One exact local case passes;
controlled delayed-save and early-admission failures show why that pass cannot
prove the original cause. Independent review approves these two test-only edits.
The next published head still requires its own CI and review.

Literal 578 remote qualification now passes all four producers and the maintained
Linux, Apple Silicon, Intel Mac and Linux ARM64 install scopes. All 18 tarballs,
source manifests and binary hashes match; no Codex payload is bundled. Native
consumer reports cover zero-turn open/close and cleanup, not paid ARM execution.
Fresh local installation/native/CLI controls pass. Its fresh DB helper fails
before migration with missing bootstrap stderr; its original cause remains unknown.
The ordinary existing-data restart separately reports exhausted Mac shared-memory
IDs. Releasing exactly two dead, unattached task-owned fixture segments restores
the app without changing host settings or other services. Installed 578 applies
migration 0340, reaches recovery ready and preserves three full agent execution
configurations, eight recorded run identities and safe account summaries, with
zero provider work. This proves upgrade preservation, not fresh initialization.
A separate ordinary installed CLI entry then starts with a new isolated home
and empty data, applies all 339 packaged migrations including 0340 and reaches
recovery ready with zero companies and provider actions. This proves fresh
startup after the owned resource cleanup; the original test-helper failure and
its missing cause remain recorded.

The original managed child-task failure remains red. Explicit first-task skill
invocation and delivery source are recorded, but the retained trace cannot prove
the model received the child-rule bytes or the complete dynamic-tool schema.
Two rejected human-input calls recover through the ordinary API; their rejected
argument shapes are not retained. Causality remains provisional. The fresh staging
image and protected check pass at literal 578; deployment is blocked by an already
active workspace deployment, with no campaign started by this QA request. Wait
for that operation before any explicit normal deployment retry. No production
or provisioning-default action is authorized.

Historical literal candidate `57881c607fcea782ac30f601b768b2142fc2184b`
passes all required checks: 53 successful checks, two conditional Storybook skips,
fresh 5/5 automated review and 28 resolved review threads. The existing hosted Linux
login/reload case passes against its recorded CI merge. The previous failed
attempts below remain historical evidence.

Normal reconciliation with master `7eea9d8214fec00dfde32bda7fcf9b20a428e330`
accepts its source-annotation Storybook/map migration. All 263 authored suites and
2503 story identities, exports and play counts remain intact. Retired aggregate
files and their review history remain in Git; current indexes regenerate as
ignored outputs. Durable creation/onboarding annotations describe fixture limits. The 28
existing tooling controls, UI typecheck, token gates and 35-area/175-ID map check
pass. Independent inspection finds no change to native execution, defaults,
onboarding, credentials, workspace, DB, CLI or packaging source relative to 578.
The isolated GitHub review-heading change and Storybook build preparation retain
their incoming master source. Fresh published-head CI/review is still required.

Literal 578 [remote package qualification](https://github.com/paperclipai/paperclip/actions/runs/38464237723)
has completed successfully. The [single managed onboarding attempt](https://github.com/paperclipai/paperclip/actions/runs/38464212481)
passes automatic selection, saved environment qualification, native authentication,
hire and reload, then completes two successful native runs with session continuity.
It fails the accepted-child assertion: the model puts its document/file on the
onboarding parent and finishes that parent despite the delivered first-task skill
requiring a child. Preserve this candidate failure; it is not a passing E2E cell
or complete task/follow-up proof. The owning verifier records six terminal lease
rows with successful cleanup, of which four appear in the selected report;
physical deletion and unpriced usage remain unsettled.

The former staging QA stack is archived with a decommissioned database. Its
normal preview preparation rejects the lifecycle before deployment. A new owned
QA workspace has been provisioned through the ordinary signup path; it still
needs candidate deployment and live verification. Previous preview/runtime proof
is historical. Heavy builds remain remote, existing-agent data stays preserved,
and no production deployment, default promotion or timer is authorized here.

Published `e301c68d645eabd9fa7ae3a9450a460f6d2d0439` passes required CI with
52 successes and two conditional skips. Its fresh review finds one linked-login
setup defect. Literal executable source `6c0eca871616a110954553d6ff971e7655c85f93`
passes [remote package qualification](https://github.com/paperclipai/paperclip/actions/runs/38445419339),
including all four producers and clean Apple Silicon, Intel Mac and Linux ARM64
consumers. Fresh installed JavaScript initializes migration0339. The existing
Mac app upgrades while preserving three full agent configurations, eight
historical runs and saved account summaries, with no provider work during upgrade.

The [managed6c attempt](https://github.com/paperclipai/paperclip/actions/runs/38448001365)
passes the saved environment probe, native account/model hello, native hire and
campaign bounds. A legitimate reload then returns onboarding to step one before
Get started. Both setup leases and fixture cleanup pass; no task/artifact/follow-up
is reached. Preserve this failed attempt. The production draft-restoration fix
passes192 existing/new controls and independent source review, including delayed
loading, explicit fresh starts, old runner choices and company/account boundaries.
The managed fixture keeps its reload assertion. The separately scoped linked-login
fix stages checked credentials only for isolated setup and keeps the general
no-follow guard, refresh target and bounded retirement contract. Its original
source passes both regular-file controls and fails both linked-file controls
after the real lower materializer omits authentication. The matching treatment
passes69 setup controls and12 unchanged lower controls, server no-emit and
independent source review. Private copies retire only after confirmed cleanup;
an uncertain close retains owned state and remains a failure.

The reviewed fix commit is `12046f522bca29ded24425be71b856993b4997f7`.
The normal merge retains exact master `393d1c410862aa93561548e0a39feec3b89df6ff`,
including migration0340, shared/plugin lifecycle contracts and file recovery.
Independent source inspection confirms all four reviewed fix hashes and the
incoming executable changes. Storybook reconciliation retains263 suites and2503
authored IDs, both review histories and all four incoming recovery states. Its
27 existing controls, maintained catalog check and35-area/175-ID map check pass.
Only JavaScript dependencies are prepared locally; native/image builds stay remote.

The combined736 source passes368 focused checks across10 files with zero final
skips. The initial sandbox listener failures are preserved separately; unchanged
support probes and owned loopback execution reach the affected tests successfully.
Incoming master `c7f4b74111d16f0b57112fa6d0b6a59c2d63bfe8` then adds fresh-task
workspace source isolation. Its eleven server files remain exact master, and281
affected source/trust/preparation/runtime controls pass without repeating the368.
The catalog retains263 suites/2503 IDs and both histories.

An actual task bootstrap check finds a narrow compatibility mismatch: an explicitly
configured or operator `CODEX_HOME` with linked auth can pass setup while task
isolation omits that link. Ordinary new defaults create no such link; regular host
logins and server-selected managed account homes seed correctly. Keep the general
no-follow guard. Use existing server-owned managed credential provenance to reject
the unbound linked case with explicit Legacy/managed-account guidance, while
retaining checked setup seeding for resolved accounts. The existing fake bootstrap
stops before provider launch; it is not live account proof. The existing trusted
outer managed credential-home context closes this mismatch without a new schema
or permission field. Four linked cases reproduce false setup success before the
guard;81 final setup controls, server no-emit and independent source review pass.
Regular homes, API-key precedence and resolved-account setup aliases remain
supported. Raw configuration cannot provide the trusted provenance.

Published `1d09569b054e0ad9f4bc9e4d92ad1212d4794f7c` retains that combined
source. Its exact-head review is4/5 with one additional selected-key precedence
finding: `CODEX_API_KEY` still enters subscription validation when the task
materializer would use that key directly. Six local/remote selected-key controls
reproduce the failure; six `OPENAI_API_KEY` controls retain their behavior. The
two-line correction skips unrelated subscription reads and refresh binding for
either selected key. Frozen treatment passes93 setup controls,12 unchanged lower
controls, server no-emit and independent source review. The first93-control run's
91 passes and two import-deadline/follow-on failures remain recorded; the unchanged
standalone run passes without extending a deadline or weakening an assertion.

The [1d CI run](https://github.com/paperclipai/paperclip/actions/runs/38459704117)
passes build, typecheck and native verification but has two independent blockers.
The onboarding browser case expects the obsolete return to the Agent step. Its
captured screen correctly restores Connect, Ada and the original authorization
link. Update that existing case to verify the exact active session, company,
name/harness/Auto choice, one login start and no pending-login hire through both
route reopening and actual reload. Independent source review passes. Local
baseline reproduces the old assertion; the final local attempt cannot initialize
its fresh PostgreSQL cluster before browser execution. Preserve that failure and
require the existing hosted Linux E2E case to prove treatment. The chat shard
loses its hosted runner connection; no failing chat assertion or test log is
available. A new ordinary current-head CI run must replace that incomplete gate.
No new image, package or paid live campaign was dispatched during these fixes.

Next action: publish the reviewed narrow corrections together. Require fresh
CI/review, affected installed-package and managed first-task proof before ready
or merge. Historical receipts keep their literal sources. The following
checkpoints are retained history, not the current merge state.

## Production preparation checkpoint — 2026-10-13

The runtime prerequisite [#16028](https://github.com/paperclipai/paperclip/pull/16028)
is ready for review at `271d434c170e74bdedde65d0b13059a55419c943`.
[CI attempt 2](https://github.com/paperclipai/paperclip/actions/runs/38346601686)
passes 54 checks with four conditional skips; fresh Greptile is 5/5 and all four
threads are resolved. The first attempt's bounded Pi Node archive timeout is
retained. The unchanged-source retry passed without relaxing source or deadlines;
its underlying network/host cause remains unknown. The passing CI installation
records merge source `7a82a37438e6e448abc7cc5caa60dc2519a97be0`, distinct from the
PR head. The [final literal-source package campaign](https://github.com/paperclipai/paperclip/actions/runs/38347027535)
passes all four daemon producers, public Linux assembly and Apple Silicon,
Intel Mac and Linux ARM64 clean consumers. The Linux ACPX component probe uses
explicit installed authority; normal Mac/ARM native lookup rejects authority
overrides. Neither establishes final cloud onboarding/task acceptance. Small
report ZIP downloads did not complete in the browser and the CLI token is invalid;
no independent current-report rehash is claimed.

GitHub's normal ready-PR gate still requires a code-owner review. On 2026-10-13,
normal protected squash auto-merge was enabled for exact `271d434c`; approval
remains pending and no slice was merged. The user authorizes normal protected sequential merges,
not admin bypasses, production deployment or provisioning-default promotion.
[Codex #15683](https://github.com/paperclipai/paperclip/pull/15683) remains clean
at `1a0ca66242121e39d88455aa2b52a07acc4a07d9`, based on the historical `5a9ce11`.
The parent has advanced and GitHub reports conflicts. Reconcile with the actual
merged parent before publishing prepared fixes or claiming final checks. The
Claude owner retains its branches, private installed-authority correction and
separate $50 qualification ceiling. Those fixes need package and live acceptance;
root does not rewrite the Claude branches.

Fresh ordinary managed onboarding currently lacks the saved platform probe
before Auto resolution; an unqualified immutable OCI environment selects Legacy.
The prepared Codex-only UI correction reuses the existing permission-gated saved
probe on explicit Connect, refreshes scoped discovery and validates the selected
runtime. It retains actionable failures, explicit Legacy and current creation/
discovery non-allocation. The existing explicit-only Product E2E cell gains fresh
wizard-owned qualification, two authoritative setup lease IDs, independently
checked physical-file output and follow-up continuity. Its fixture does not
create an agent or preprobe. Missing responses preserve unknown cost coverage.
No new suite, grader, automatic roster or local-prompt replacement is introduced.

The privately composed source passes 44 targeted onboarding controls and 184
existing Product E2E support controls, UI/E2E no-emit and guarded patch
applicability. The earlier full wizard controls pass 117 cases at their recorded
source. Independent review found an unanswered-setup accounting gap: four cases
fail before the fix; 117 first-task controls pass after. Comment cleanup preserves
353,839 composed executable tokens and semantic ASTs. Required onboarding maps
retain IDs, actual probe authority and source-only/not-run limitations; structural
checks pass 35 areas/171 IDs. Storybook metadata must be reviewed after actual
parent reconciliation; its catalog/script are absent from literal `1a0ca662`.
This private preparation is not integrated, published or live-qualified.

A private reconciliation rehearsal composes exact Codex `1a0ca662` with exact
prerequisite `271d434c` without modifying either published branch. It retains
master's render helper, moved Storybook paths and additional catalog cases; the
managed onboarding cell is added to the existing catalog with 730 total cases.
The rehearsal is not an actual post-merge candidate and does not close hosted,
installed-package or live Cloud acceptance. Its narrow checks and source manifest
remain private until normal source reconciliation is authorized by the actual merge.

The private root review reproduced four cache failures under production
`staleTime: 30_000`: setup omitted fresh availability reads, hid a discovery
error, and skipped qualification after an image change. Both managed Codex
setup reads now set `staleTime: 0`. The same existing controls cover cold and
production-cache defaults; 53 selected UI controls and matching-source UI
no-emit pass on Node 24.19.0. Earlier 44-case results remain tied to their
pre-correction source. This correction is private and requires ordinary
published-head review and full qualification after the protected parent merge.

Cloud source `23531d729756ab0461a53f9358beb8df5c1781ed` uses named Daytona
snapshots without a verified final boot-image binding for fresh-company native
qualification. A read-only metadata request was rejected before execution because
automatic approval review requires explicit use of the particular API key.
Authorization is pending; no key was read or provider request sent. The expired
GitHub device code needs a new attended sign-in when the human is present.
Production Fleet Admin sign-in and a concrete current QA owner grant also remain
pending. The existing QA tenant remains pinned/user-managed and unqualified;
old auth probes and preview images cannot close the live gate.

The original $250 ceiling and $248.179254104 held/consumed ledger remain intact;
unknown charges and cleanup holds are not certified invoice balance or available
funding. Codex retains its bounded $2.50 setup/two-task-turn reservation plus $2
cleanup. The expanded manual first-task cell has no separate paid reservation.
No provider turn, paid environment allocation, local Docker/Cargo/native build,
rollout or default promotion occurred in this preparation. The preserved local
preview remains `http://127.0.0.1:3125/COD/agents/all`, literal behavior source
`fe1ecf1c3449c21d6e6f0c9d9772d1949b80ea82`; its data and recorded runners remain
untouched. Root does not upgrade existing agents.

Next gate: obtain actual code-owner review and restored GitHub CLI authentication,
then perform the normal exact-head parent merge and reconcile Codex/Claude with
its actual master commit. Compose these prepared fixes, retain required maps and
fresh review/checks, resolve the Cloud boot-identity boundary through authorized
metadata, and qualify the final immutable managed candidate. Actual private
Cloud distribution, warm/cold signup, useful task/follow-up, existing-agent
preservation and production-image rollback/forward-recovery checks remain open.
The stack is not production-ready and production deployment remains unauthorized.

Evidence: `/private/tmp/pr2-271d434-final-qualified-ready-receipt.json`,
`/private/tmp/pr2-managed-onboarding-accounting-root-review.json`,
`/private/tmp/ci-artifacts-271d434-installed-native-lookup-audit-receipt.json` and
private composed source manifests. Public PR bodies contain the exact current
checkpoint; historical receipt sources remain literal.


Updated 2026-10-13 UTC.

## Fresh cloud onboarding remains unqualified

The source audit found two ordinary-use gaps in the dependent release. Codex
onboarding resolves Auto from saved environment facts before setup testing.
The normal setup path does not perform the saved environment platform probe.
An immutable OCI environment without prior facts therefore creates a Legacy
agent. Existing managed E2E fixtures explicitly probe first; those fixtures do
not prove fresh onboarding. A private UI correction is being tested against
the existing onboarding suite. It uses the existing permission-gated saved
probe on explicit Connect, refreshes company-scoped discovery, then tests the
selected runtime. Creation and discovery still allocate nothing. Probe errors
must stay actionable, and permissions must not broaden.

Cloud master `23531d729756ab0461a53f9358beb8df5c1781ed` distributes named
Daytona snapshots. Its recorded runtime image digest identifies the app copied
into that snapshot, not the final boot image. Current source does not bind a
fresh company's qualification to a verified boot identity. The pinned official
Daytona SDK accepts snapshot IDs, but does not guarantee a boot-verified digest.
A read-only lookup of the existing snapshot was rejected before execution by
automatic approval review because direct credential authorization was missing.
The exact limited authorization is now requested. No key was read or request
sent. Source audits and CLI version probes do not close live cloud acceptance.

These are release blockers for the Codex-default and actual Cloud distribution
stages, not new runtime changes in this prerequisite. No source is merged or
production-ready. The original budget holds, local preview, existing runners,
remote-build boundary and no-production-deployment boundary remain intact.

## Held-authorization fixture correction

The ordinary reconciliation candidate `dae808fe02694d13d322c535944910813b21f6d6`
has fresh Greptile 5/5, all four resolved threads, passing isolated native
compilation and the required browser aggregate. Its runner shard passes both
previously corrected cases, but fails a different `authorize_before_bootstrap`
cell: the same implicit one-second polling deadline expires before the fixture
installs its release callback. The shard records 1,672 passes, one failure and
three skips. The exact failure and gate receipt remain:
`/private/tmp/ci-final-dae808-ci-review-failure-receipt.json`.

The existing fixture now signals actual entry after installing the release
callback in the exact before-bootstrap authorization hook. Race that signal
against the original recovery request under the unchanged five-second bound.
All authority, stage, denied-work, command queue, process, provider-state,
durable-byte and cleanup assertions remain. On canonical Node 24, controlled
1,250 ms scheduling delay reproduces the old undefined-callback assertion and
passes after correction. An injected early recovery error surfaces unchanged.
The original hosted cause remains inconclusive; this proves fixture weakness
and preserves the next diagnostic. These are historical-mock-binary controls,
not final installed runtime qualification. Matching-source independent review
is clear. Receipts:
`/private/tmp/ci-final-dae808-held-authorization-signal-receipt.json` and
`/private/tmp/pr2-dae808-held-authorization-independent-review.json`.

The already-running package campaign
https://github.com/paperclipai/paperclip/actions/runs/38342104102
is immutable to literal `dae808` throughout: daemon, assembly and installed
consumer checkouts use its explicit 40-character SHA, while the tooling checkout
uses the captured workflow SHA. Publishing this test-only correction cannot
change that run's source. Let it finish without rerun or cancellation, keep its
receipts literal and overlap fresh current-head CI with its remaining steps.
No new package campaign starts until the existing one is terminal.

Both worktrees and root's test-drive data stay preserved. Its loopback health
is OK at literal `fe1ecf1c34`, recovery ready, zero active runs; a sandbox-blocked
read was corrected with the authorized read-only loopback path, without restart
or build. Root HEAD stays `1a0ca662`. Codex and Claude reconciliation/acceptance,
normal code-owner approval, private Cloud composition and production baseline
remain pending. No merge/deployment/default promotion, paid provider call,
new paid host or local native/Docker build occurred.

## Final CI fixture corrections and current master

Published prerequisite `16a53254c495f3e49a28cc911f5dcd60c41779fc`
has fresh Greptile 5/5 and all four review threads resolved. Full CI records
52 successful checks, four conditional skips and two failures: the runner
Vitest first shard and its aggregate. The actual failing shard passes 1,671
cases and skips three; its two failures remain recorded in
`/private/tmp/pr2-16a532-runner-vitest-failure.log`.

The durable-resume case exceeded its outer five-second test envelope. Reuse
Claude owner's existing correction from `c60bf4b6`, changing only that case's
outer limit to 15 seconds. On canonical Node 24, controlled 3,800 ms fake
latency reproduces the old outer timeout, while corrected and ordinary cases
pass. Internal 500 ms/5 second turn deadlines, distinct attempts, same thread,
effect deduplication and the complete usage assertions remain unchanged.
Receipt: `/private/tmp/pr2-16a532-durable-resume-correction-receipt.json`.

The warm-recovery callback fixture polled callback installation with Vitest's
implicit one-second wait, despite its existing five-second request bound.
Replace polling with actual callback-entry notification raced against request
settlement under that same bound. Controlled 1,250 ms scheduling delay fails
the original assertion and passes the correction; an early recovery error now
surfaces unchanged. All fence, snapshot, retry and side-effect assertions remain.
The original hosted request outcome was hidden, so its underlying cause remains
inconclusive until fresh hosted CI. These controls use recorded historical mock
binaries and do not qualify a final native package. Receipt:
`/private/tmp/ci-final-16a532-warm-callback-signal-receipt.json`.
Independent matching-source review of both test-only changes is clear:
`/private/tmp/pr2-16a532-fixture-corrections-independent-review.json`.

Current master `e168512f7bdbb6af6ea01954c6d7ed80b91e903e` merges cleanly.
Runner/surfaces/server/E2E no-emit checks pass on the composed source. Maps
remain aligned at 35 areas/171 IDs and token gates pass. Master changed three
activity/inbox/recovery recipes without synchronizing 25 catalog fingerprints.
Independent inspection verifies those entries are exact inherited master drift;
all 92 declared non-map story/component/wrapper/fixture inputs are unchanged.
Only their guarded fingerprints and a source-only review note are synchronized.
Existing 24 unreviewed/one current classifications, IDs, fixtures and INDEX stay
unchanged. The catalog check passes 223 files/2,210 stories. No new live or
visual coverage is claimed for the inherited backend requirements.

The exact `16a532` remote package campaign is
https://github.com/paperclipai/paperclip/actions/runs/38338806076.
The campaign completed successfully. All four native producers, public Linux
package assembly and the Apple Silicon, Intel Mac and Linux ARM64 installed
consumers pass. The earlier Intel timeout remains a separate failed receipt;
this success does not establish its cause or a diagnostic-code fix.
This remains literal source evidence after the current master/test changes.
No queued job is rerun or obsolete package result relabeled.

Next action: preserve the completed package result, publish this ordinary master
reconciliation with both scoped fixture corrections, require fresh full CI and
review, and qualify the final package source. The prerequisite remains draft,
auto-merge off, and actual code-owner review is pending. Codex stays `1a0ca662`
until actual prerequisite merge and source reconciliation; the Claude owner
retains its branches and separate $50 allowance. Final immutable managed QA,
actual private Cloud distribution, warm/cold signup and backward-image or
forward-recovery evidence remain required. Production Admin sign-in is pending.
Nothing is merged, deployed or production-ready. The idle root test-drive and
its data are preserved. Paid holds remain $248.179254104/$250; no provider turn,
new paid host, local native/Docker build, rollout or default promotion occurred.

## Master reconciliation and installed-package checkpoint

The published prerequisite `64c074fb8da1b31f8d6042c4fef48dc4164e759b`
passes 54 current-head checks with four conditional skips and fresh Greptile 5/5.
All four review threads are resolved. The actual hosted transport suite passes
246 tests and startup trust passes 22; this closes the earlier local fake-binary
limitation at that literal source. Full workspace checks, Linux DB controls,
Rust suites, isolated native compilation and all eight browser shards pass.
Receipt: `/private/tmp/pr2-64c074-full-ci-review-0144-receipt.json`.

The [existing final package campaign](https://github.com/paperclipai/paperclip/actions/runs/38332921463)
completed on literal `64c074`. All four native producers, public Linux package
assembly, Apple Silicon and Linux ARM64 installed consumers pass. Intel Mac
fails during initial `npm install --ignore-scripts --omit=dev`, with `ETIMEDOUT`
after the existing 10-minute bound. It never reaches lifecycle or native runtime
assertions. The log establishes an installation timeout, not its network/host
cause and not a runner failure. Intel installed execution remains unqualified.
Keep the failed receipt; do not relax assertions or relabel the successful
platforms as a complete campaign. No automatic retry was dispatched.

Master then advanced to `f329b24ee12496e710ad17377ec7716e0eee22ef`, adding
separately merged durable task workspaces. It conflicts only in the test-home
helper/test and the Storybook review record. Both independent additive resolution
proposals are preserved. The cleanup keeps guarded read-only permission recovery
and its unrelated-ENOTEMPTY negative, adopts master's POSIX error assertion,
and retains master's new isolated-home identity/symlink protections byte-for-byte.
Both source-only Storybook review appendices remain; the catalog merges without
new story/fixture edits or changed review classifications. The task-workspace
migration and runtime changes come from master, not this PR's feature scope;
final image/migrator and backward-image proof must include them.

The composed worktree passes six existing home controls, with zero failures or
skips, plus runner/surfaces/server/E2E TypeScript checks, token gates, both map
checks (35 areas/171 IDs) and Storybook structure (223 files/2,210 stories).
Only scratch-local TypeScript preparation ran; root's idle test-drive and data
stay unchanged. The contribution check has no below-1,000-to-above-1,000 code
crossing. The two whitespace lines already in master's unrelated privacy test
are not modified; the PR diff against master is clean. The review remains 63
files. These composed checks have their working-tree source identity and are not
claimed as execution of the old published commit. Receipts are
`/private/tmp/pr2-f329-uncommitted-home-controls-receipt.json` and
`/private/tmp/pr2-f329-composed-source-checks-receipt.json`.

The existing Mac installer now retains bounded npm timing/progress diagnostics
in its already-uploaded receipt path before cleanup. Only allowlisted metadata
is retained; argv, URLs, environment, raw stderr and exception text are omitted.
At most two 16 KiB file tails and 32 entries per tail are read. Symlink exclusions
and the original exception identity remain. Failure is explicitly FAILED,
unqualified and runtime-not-attempted. The existing 10-minute deadline and all
package, lock, payload, lifecycle and startup oracles are unchanged. Three narrow
cases extend the existing suite; all 24 pass on canonical Node 24, and independent
matching-source review is clear. This adds diagnostics, not an installation
success or explanation of the old timeout. Receipts:
`/private/tmp/pr2-mac-initial-install-diagnostics-repair-receipt.json`,
`/private/tmp/ci-final-mac-install-diagnostics-independent-review.json` and
`/private/tmp/pr2-f329-install-diagnostics-node24.log`.

Next action: publish the ordinary master-reconciliation commit, require fresh
full CI/review and exact-source package qualification, then normal code-owner
review and merge. Prior `64c074` CI/install receipts remain literal after this
source change. The Claude owner is waiting for the exact canonical parent before
its next composed campaign; keep all its Claude fixes and separate $50 allowance.
Codex remains `1a0ca662` until actual prerequisite merge and reconciliation.
Final immutable OCI QA onboarding/task/follow-up, private Cloud composition,
warm/cold signup and backward-image or forward-recovery proof remain required.
Production Fleet Admin sign-in and code-owner approval are still pending.
No slice is merged or production-ready. Paid holds remain $248.179254104/$250;
no new paid/provider action, local native/Docker build or rollout took place.

## Production readiness: owned startup correction

The human requests production readiness; preparation and normal sequential
merges remain authorized. Production deployment and provisioning-default
promotion remain separate actions. Nothing in this checkpoint is merged or
deployed, and the stack is not production-ready.

Runtime prerequisite behavior is `ce23716503a2c9158b5a7ab74ab61571ff4ee7a3`
on `codex/runner-native-platform-prerequisites`, in
[#16028](https://github.com/paperclipai/paperclip/pull/16028). Final qualification
reproduced close returning before credential preparation drained, followed by
registration and launch. Both direct close and real driver cancellation failed
on literal `5a9ce11`. The initial shared repair from Claude commit `463ebb` is
reused, with independently identified duplicate-admission, shutdown-readiness and
resume ordering corrections. All five source findings are closed in matching
source review. Absolute cleanup deadlines, primary cancellation errors,
unauthenticated-process protection and existing agents' runner choices remain.

The existing suites pass 32 credential-free controls across three files; both
canonical runner TypeScript no-emit checks pass. No new suite, local Rust/Docker
build, provider call or credential-content read was used. Actual daemon
readiness/recovery controls remain **hosted-CI required**: local worktrees lack
the existing fake-Codex/fake-harness executables. The failed local native attempt
never reached the readiness assertion and is not qualification. Receipts are
`/private/tmp/pr2-463ebb-owned-startup-review-closure-receipt.json` and
`/private/tmp/ci-final-owned-startup-five-gap-closure-review.json`.

Normal automatic merge is disabled and the prerequisite is draft while this
correction receives fresh full CI, package qualification and 5/5 review.
Earlier green checks at `5a9ce11` remain historical. Actual code-owner approval
is still required; no protection is bypassed. The updated runs/adapters map pair
records source-only scope, bringing the prerequisite review to 63 files after the required Storybook
catalog review below.

Codex remains `1a0ca66242121e39d88455aa2b52a07acc4a07d9` in
[#15683](https://github.com/paperclipai/paperclip/pull/15683), based on the previous
prerequisite. The Claude owner retains its branches, cached guided-setup fix,
verification and separate $50 allowance. Coordinate reconciliation of the common
repair before rewriting those branches; don't duplicate it in a leaf slice.

The idle [local preview](http://127.0.0.1:3125/COD/agents/all) still serves literal
behavior `fe1ecf1c34`, recovery ready and zero active runs. Its four saved
legacy/native configurations and two historical native records remain preserved;
it has not been refreshed to this new runtime. Final local/managed acceptance
must use the tested source, independent file checks and follow-up continuity.

The prepared private execution checklist reuses existing evals, installation,
Cloud composition and campaign paths. Required holds are final source/image/
migrator, the actual verified-master private distribution, pinned QA onboarding,
warm/cold signup, production baseline and previous-image compatibility. Production
Fleet Admin sign-in is pending. Current paid holds remain $248.179254104 of $250;
unknown/cleanup holds stay reserved, and the unstarted managed envelope is $2.50.
No new image, paid resource, rollout or default promotion was dispatched.

Master reconciliation uses `4b958ecbd8f33a7782fe6f29ec825f80f636b833`.
The new contribution rules are satisfied: 157 added comment annotations were
removed from 35 files, with identical executable JavaScript/TypeScript emission,
parsed workflow values, 77 action pins and shell commands. No code file crosses
from below 1,000 lines to above that limit. Final focused checks pass 248 tests
(107 workflow/package, 54 runner, 42 server, 45 E2E support). Both runner no-emit
checks and the canonical server/E2E no-emit checks pass with isolated matching
workspace dependencies. Only JavaScript/TypeScript preparation ran locally;
root preview links and data stayed unchanged. The earlier linked-source failures
remain recorded and are superseded only by the new canonical check receipt.

The existing Storybook catalog has 21 source-review fingerprint updates because
its declared runs/adapters map input changed. All affected stories, subjects,
wrappers and fixtures remain byte-identical to master. Review classifications
stay unchanged. The catalog check passes 223 files/2,210 stories; this is
structural/source evidence, not visual or live proof. Source receipts are
`/private/tmp/pr2-9f59-comments-cleanup-receipt.json`,
`/private/tmp/pr2-storybook-owned-final-receipt.json` and
`/private/tmp/pr2-frozen-canonical-noemit-receipt.json`.

Next action: publish this reviewed prerequisite correction, require fresh hosted
gates, reconcile Codex and Claude with its actual source, then resume the existing
remote package/immutable preview and dedicated staging qualification. Merge ready
slices normally in the agreed order; actual production readiness requires the
private distribution and rollback/forward-recovery evidence afterward.

## CI fixture, network policy and map synchronization checkpoint

Runtime prerequisite source is `5a9ce11c49db31440863d633426ebe30bcc850ca`
with 59 changed files. The hosted static check on literal Codex source `eee0534`
passed 133 cases and failed one: its isolated assembly fixture omitted the new
target JSON, so the helper failed before its existing Cursor-identity assertion.
The fixture now copies that exact inert JSON; all negative assertions remain.
Baseline provider-pack controls reproduced eight passes and one failure;
treatment passes nine, with 16 related provider/assembly controls passing.
No local Cargo or Docker build was used.

Codex behavior source `fe1ecf1c3449c21d6e6f0c9d9772d1949b80ea82` fixes the
fresh no-network P1. Effective Legacy ACP restrictions, including plain or
unresolved secret bindings, now fail native selection with field-specific Legacy
guidance. The unused flag for an explicitly selected CLI, existing Legacy/native
execution, and trusted server-owned native network policy retain their behavior.
Five failures reproduced before correction; all 112 selection controls, canonical
server no-emit, and independent source review pass. No secret was read or native
network authority translated to an agent setting.

The replacement user AGENTS.md requires synchronized feature/access maps in the
same change. Eight existing documents now describe the affected behavior and
access limits: the environment pair belongs to the prerequisite; agents,
onboarding and runs/adapters pairs belong to Codex. The Codex review is 105 files,
comprising its original 99 plus six required map documents. Preserve required
documentation and useful tests rather than satisfying the lower-priority former
100-file preparation guideline by dropping them. IDs, original baseline review
scope and indexes remain intact. Both structural checks pass 35 areas and 171
capability IDs. Scoped source references are separate from live proof; all new
agent/provider map recipes remain explicitly source-only/not-run. Independent
map and fixture review is clear.

The [local preview](http://127.0.0.1:3125/COD/agents/all) serves this behavior
source as `2026.1005.0+407.git.fe1ecf1c34`. Four complete execution configurations
and two historical native runs survive the controlled restart unchanged, recovery
is ready, active runs are zero, and the deprecated flag remains false. Receipts:
`/private/tmp/pr2-fe1e-preservation-{before,after}.json`. Staged daemon preflight
required no source build. Provider actions, Cargo builds and Docker builds are
zero. This record's subsequent commit changes documentation only.

Current-source full CI and fresh review remain gates. Prior `eee0534` hosted
typecheck, build, Rust, Canary and eight E2E shards passed, while aggregates were
incomplete; those results are not relabeled as the new head. Prior prerequisite
`d16eccf` had fresh 5/5; the new source requires review again. The Claude owner
is carrying these shared changes and owns its separate fixture corrections and
verified explicit effort-clear semantics. No final image, merge or production
deployment has occurred. Managed onboarding/task/follow-up remain pending.

## Codex configuration review closure checkpoint

Runtime prerequisite [#16028](https://github.com/paperclipai/paperclip/pull/16028)
advances to `d16eccf109b524778ceb896f79ccb3881bc61a9b`, with 57 files. Its small
shared builder correction preserves saved or selected Codex reasoning effort
without adding Codex settings to other providers. All 52 existing builder tests
pass in the actual prerequisite checkout. The earlier `cae179` fresh 5/5 review
is retained historical evidence; this new source requires fresh checks/review.

Codex behavior source is `b63b779fe141ffe8db6d200580335de84ee78651`, on
`codex/codex-runner-default`; [#15683](https://github.com/paperclipai/paperclip/pull/15683)
retains 99 changed files. Review reproduced eight selection failures and six
import/builder failures before correction. All six actual ACP aliases now follow
Legacy precedence before native compatibility checks. Unsupported settings name
the effective source field and offer explicit Legacy; Legacy itself is unchanged.
Native imports retain hidden runtime settings and account bindings through
ordinary edits. Explicit clears/removals and intentional harness changes remain
effective. Existing controls pass: 100 selection, 91 UI, and 52 builder; counts
can overlap. Canonical server/UI/adapter no-emit, token gates, and independent
source-matching reviews pass. No new suite, schema, or API was introduced.

The [local test-drive](http://127.0.0.1:3125/COD/agents/all) restarted on this exact
behavior source and serves `2026.1005.0+403.git.b63b779fe1`. Startup recovery is
ready, active runs are zero, and all four complete legacy/native execution
configurations and two historical native run records match before/after.
The deprecated flag remains false. Prefix-specific receipts are
`/private/tmp/pr2-b63b-preservation-{before,after}.json`. The staged Mac daemon
passed preflight with `sourceBuild=false` and `needsBuild=false`; startup used
JavaScript preparation only. Provider actions, Docker builds, and Cargo builds
are zero. This checkpoint's subsequent commit changes only this dated record.

Current-head full CI/review and managed onboarding/task/follow-up remain required.
No merge or production deployment has occurred. Keep expensive final previews
deferred until the prerequisite merges and Codex is reconciled with actual master.
The authorized Claude owner is coordinating its dependent PRs and existing
bounded evidence; root retains normal sequential merge ownership.

## Metadata review closure checkpoint

Runtime prerequisite source is `cae179c21412048d08aeb94e0fe8b0f7844119de`,
with 55 changed files; Codex remains 99 files. Two fresh metadata review P2s
are fixed: explicit null clears user metadata, and saves preserve only the
latest private platform proof through an atomic database update. Config/driver
updates invalidate proof in the same write; status cleanup retains its existing
archive-token behavior. Public callers cannot supply the proof.

The three existing environment suites pass 83 controls. Seven focused tests
exercise real PostgreSQL writes between request preparation and save; there are
42 name-filter exclusions and zero host-guard skips. Both canonical server
no-emit commands pass. Source hashes match in both worktrees and independent
review is clear. A separate read-only audit confirms no actual company/team
import bypass or proof export: portability does not copy environment rows, and
environment API responses strip the private subtree. No new infrastructure,
provider turn, Docker/Rust build or schema/API change was introduced.

Fresh exact-head full CI/review remain required. The verified Mac preview restart
at `64d0746f8a` preserved four execution configurations and two historical native
runs with the deprecated flag false and no provider actions. Refresh the idle
preview to the next recorded head; old measurements retain their literal source.
Merge the qualified prerequisite first, then reconcile Codex with actual master
before the final remote image and managed acceptance. No merge has occurred.

## Fixture closure checkpoint

The runtime prerequisite advances to `093b97aa12` with 54 files. The Codex
review remains 99 files. Existing managed fixtures now run the saved environment
probe before native-generation Codex creation and inspect server defaults only
for automatic requests. The owned setup probe lease joins the existing runtime
estimator, with unrelated leases excluded from task attribution. The fixture
contract records one setup lease per eligible cell, zero provider turns, zero
retries, a 330-second HTTP deadline and a 10-second platform command deadline.
Archive/release, expiry and failure-cost holds remain unchanged.

Both worktrees pass 36 existing fixture/billing controls and canonical E2E
no-emit. Existing catalog/report controls pass 46 cases, and core compatibility
discovery succeeds. Affected adapter discovery/setup routes pass 69 controls.
Unknown sandbox facts now expect Legacy; measured GNU2.39 ARM64 expects native.
All checks use fixtures, not paid provider proof. Exact-head hosted CI/review and
real managed onboarding/task/follow-up remain pending. No merge has occurred.

## Corrective source checkpoint: ready for fresh CI and review

Runtime prerequisite source is `cf19e086ae4a0142c8b4314771c55f73b294805b`
on `codex/runner-native-platform-prerequisites`, with 50 changed files. The
Codex-default branch `codex/codex-runner-default` is composed on it and retains
99 changed files. Both reviews remain under 100 files. All four original review
findings and the relevant independent-review follow-ups are fixed.

Existing controls pass: release workflow 70, assembly 7, registration 15,
measured environment/probe routes 32, UI permission/forms 207, and selection/import
140. Counts describe separate runs and can overlap. Canonical server, runner and
UI no-emit checks and token gates pass. Source-matching independent reviews
confirm cleanup, immutable-image binding and saved Legacy permission handling.
No local Docker/Rust build, new provider turn, or agent migration was used.

Remaining gates are fresh exact-head full CI/review and managed Codex acceptance.
The existing managed eval catalog already requires OCI digests. Its image-backed
fixture helper must use the existing explicit environment probe before automatic
Codex creation and inspect the stored default; explicit-runner coverage remains
separate. First-task onboarding fixtures are local-only, so fresh managed
onboarding still requires live proof. The pinned fleet tenant currently uses a
name-only snapshot and cannot establish native-default compatibility. Use a
qualified immutable image-backed QA environment, preserve the tenant pin, and
verify the serving commit and independently checked task/follow-up artifacts.

Merge the prerequisite after its applicable checks pass. Then reconcile the
Codex PR with actual master, verify its final source, and build the immutable
preview and DB/shared pair remotely once. All three cancelled previews remain
excluded. The original budget and cleanup holds remain unchanged. Claude owns
its separate bounded proof and downstream attestation reconciliation. No merge
or production deployment has occurred at this checkpoint.

## Final review checkpoint: shared fixes and sandbox qualification

The user authorizes normal sequential merges after the applicable gates pass.
Runtime prerequisite [#16028](https://github.com/paperclipai/paperclip/pull/16028)
and Codex defaults [#15683](https://github.com/paperclipai/paperclip/pull/15683)
remain draft. Their pre-fix sources are `00ac509b0a` and `8de43be4cd`.
The shared SSH argv and verified cold-resume corrections are already composed.
Six argv controls, fourteen recovery controls, and actual SSH subprocess checks
pass. The separate Claude owner reports real ARM and Linux x64 task/follow-up
pairs across controller restarts on its literal installed-package overlays;
those results do not qualify an unmodified final Codex package.

The Mac test-drive serves `8de43be4cd` at port 3125. A read-only restart comparison
preserves four full legacy/native execution configurations and two historical
native runs with the deprecated native flag false. Zero provider turns and
zero local native/Docker builds were used. The canonical server no-emit passes
on the composed root and actual prerequisite worktree.

Both shared fixes are implemented and frozen. The actual workflow selector
rejects candidate execution/output injection in real Git fixtures. Its full
existing release-workflow suite passes 70 tests; existing target assembly passes
7 tests. Registration passes 15 focused controls and canonical runner no-emit.
An independent scoped review confirms bounded teardown and retained private
state on unconfirmed release. The first broader local workflow attempt failed
only because mock loopback listeners were sandbox-blocked; its loopback-enabled
rerun passes. No daemon/provider execution was used by these controls.

The generic sandbox qualification support passes 30 existing probe and route
controls plus the canonical server no-emit command. It accepts only OCI digest
images, checks the returned cleanup receipt, and reports conditional-update races
without claiming a record. Mutable or name-only configurations retain existing
connection behavior and receive no native compatibility credit. The default
consumer and explicit-permission/import controls are being composed next.

Fresh review found four source defects: candidate-code execution during CI runner
selection, unbounded registration teardown, a lost explicit Codex permission
setting on automatic Legacy selection, and missing sandbox platform/libc facts.
Existing subagents own narrow fixes in parallel. Use inert target data and
workflow-owned public labels; preserve primary failures and private state on
unconfirmed cleanup; preserve explicit permissions; and use server-measured
sandbox qualification bound to its effective image/config and company scope.
The existing explicit environment-probe/setup flow owns qualification. Saving
and discovery must not provision resources or accept client-authored evidence.
Unknown targets retain automatic Legacy with an actionable explicit-native error.
No new product API or database migration is planned.

Preview runs [38303434211](https://github.com/paperclipai/paperclip/actions/runs/38303434211),
[38304889308](https://github.com/paperclipai/paperclip/actions/runs/38304889308), and
[38306885592](https://github.com/paperclipai/paperclip/actions/runs/38306885592)
were cancelled as shared source defects changed their candidates. They are
excluded from final qualification. Preserve historical evidence and all cost
and cleanup holds. The next action is to finish the four fixes, run affected
controls, obtain fresh exact-source checks/review, then build the final immutable
preview and matching DB/shared pair remotely for the pinned QA tenant.
Managed Codex retains its $2.50 setup/task envelope and $2 cleanup within the
original $250 ceiling. Claude retains its separate $50 ceiling. No merge or
production deployment has occurred.


## Latest checkpoint: runtime prerequisite and authorized merges

The user authorizes preparing and merging ready PRs in dependency order.
Production deployment and provisioning-default promotion remain separate actions.
The Codex-default candidate is preserved at
`bb7591dfd0c4c8569e2a0b4303ff06de8ca3e9e2`; its running test-drive remains at
[3125](http://127.0.0.1:3125/COD/agents/all). No existing agent changes runner.

Its qualification work grew the review to 135 files. Extract the independent
runtime, installed-package and hosted-build changes onto
`codex/runner-native-platform-prerequisites`, based on master
`7d9b93aee2b79b2f035c5838741ce0b94168ec83`. This prerequisite contains 39 source
files and this record. Creation policy and experimental gates remain identical
to that master. README activation text and eight existing default-selection
controls stay in the dependent [Codex PR #15683](https://github.com/paperclipai/paperclip/pull/15683),
whose expected review is 98 files. Preserve all work and both branches.

The isolated extraction passes 276 existing focused controls. Runner no-emit
passes. The standard server no-emit initially finds a linked dependency-output
skew: the new master's ACP constants are absent from the old checkout's compiled
adapter-utils. A source-aware diagnostic passes; canonical verification remains
pending until its matching JavaScript dependency is prepared. Full hosted CI,
native compilation and fresh review are still required for the extracted head.
Do not count the diagnostic as a passing standard command.

Retained qualification keeps literal identities: four producers and Linux x64
and both Mac consumers pass at `a200495`; installed ARM native startup passes
with scoped stock Ubuntu prerequisites in
[38291535914](https://github.com/paperclipai/paperclip/actions/runs/38291535914).
Those artifacts are not relabeled as the extracted source. The Linux baseline
is GNU libc 2.39+, on x64/AArch64. Windows and Alpine remain deferred.
Cargo caches and overlapping JavaScript/native preparation use existing hosted
workflows. No local Docker/Rust builds or bundled Codex payloads are introduced.

Merge order is runtime prerequisite, Codex defaults, then the existing Claude
[protocol #15994](https://github.com/paperclipai/paperclip/pull/15994),
[default #15993](https://github.com/paperclipai/paperclip/pull/15993), and
[platform #15997](https://github.com/paperclipai/paperclip/pull/15997) PRs.
The authorized Claude chat owns its verification and fixes; this task coordinates
normal squash merges after applicable gates. The older Grok Cloud PR is an
independent lane, with its own missing snapshot-cleanup access and live proof.

The extracted [runtime prerequisite #16028](https://github.com/paperclipai/paperclip/pull/16028)
is open at `ddcd746eb6a01f2bbe9b4adeec238ba35bde5adb`. The default branch is
composed on it with all 134 owned implementation/test files identical to
`bb7591dfd0`; this record retains every historical checkpoint.
Next action: require current-source CI/review and remotely prepare the exact
composed Codex staging image and DB/shared pair. The existing QA tenant remains pinned to
old `2dbe43a4`. Managed Codex retains its $2.50 setup/task envelope and $2 cleanup;
historical unknown holds remain within the original $250 ceiling. Claude has
its separately authorized $50 ceiling. Missing live proof remains unresolved.


## Retained checkpoint: ARM qualification and master integration

The Rust daemon, protocol, Codex driver, creation policy, and provider
requirements remain unchanged from qualified source
`a200495cc7488f4d59da570407e516cf702e5af8`. Its verified 18-package archive
retains that literal identity. All four hosted daemon producers, Linux x64 clean
installation, and both Mac installed startup/cleanup consumers pass. The original
unprepared ARM failure remains recorded; qualified ARM startup passes with stock
scoped OS prerequisites and no global restriction change.

The [committed-helper consumer](https://github.com/paperclipai/paperclip/actions/runs/38290234153)
passes using tooling `0690801` and literal `a200495` packages. Receipt:
`/private/tmp/ci-final-0690801-integrated-arm-receipt.json`.
Fresh review at `a5b1683` is 5/5, with all 16 threads resolved. That correction
loads the helper from the immutable workflow definition rather than an older
frozen product checkout that does not contain it. A separate sparse checkout
uses `job.workflow_repository`/`job.workflow_sha`; both source identities and
the helper digest enter the existing report. No mutable branch or caller-source
fallback is used. The original product consumer and archive guards stay intact.

The [actual final workflow wiring](https://github.com/paperclipai/paperclip/actions/runs/38291535914)
also passes: immutable helper checkout, stock prerequisite preparation, native
session, default daemon, read-only model context, and joined cleanup. Its three
critical steps are byte-preserved from the delivery workflow. Literal product
source is `a200495`, definition base is `a5b1683`, and actual tooling source is
`8eb3595a`. All 18 packages and lock/daemon/official-launcher/native-payload
hashes remain unchanged. Global restrictions stay 1/Y/1; scoped profiles stay
enforced. No overlay, direct-control substitute, Rust rebuild, credentials, or
provider turns were used. Receipt:
`/private/tmp/ci-final-a5b1683-final-wiring-receipt.json`.
Normal OS APT installation and paid ARM task/follow-up remain unproven.

Master `82274853729f8c5b0f812da08595020f7eb64d66` requires one test-fixture
conflict resolution. Its shared test-home cleanup replaces the duplicate
traversal. Real Mac Node 24 tests expose `ENOTEMPTY` for read-only descendants;
the shared helper now retries only after restoring owned directory permissions.
Unrelated errors remain visible; symlinks and immutable file modes stay intact.
All 84 fixture/selection controls, server typecheck, 80 merged workflow/cache
controls, and token gates pass. Both master's general release-crate cache and
this branch's native producer dependency cache remain. Receipts:
`/private/tmp/codex-default-master-home-cleanup-fix-receipt.json` and
`/private/tmp/codex-default-master822748-readonly-audit.json`.

Master's heartbeat extraction updates server orchestration. Historical frozen
package startup and useful-task evidence remain component proof with literal
revisions; they are not relabeled as complete current-server onboarding proof.
The last verified preview restart serves `2026.1005.0+352.git.0690801f13` at
[3125](http://127.0.0.1:3125/COD/agents/all), preserving all four agent
configurations and both historical native runs. The downloaded Apple Silicon
daemon requires no source build or binary override.

Fresh review at `665c155` reports three valid findings. Remote sandbox setup and
execution now share the existing actual-target OS/architecture resolver rather
than selecting the Mac controller's daemon. Thirteen new baseline failures
reproduce the issue; 124 target/setup/backend and retained-artifact/version
controls pass after the fix, with server typecheck. Header, digest, preinstalled
artifact, and remote build-metadata verification stay strict. Foreign artifacts
are read/hashed on the controller and executed through the remote launcher.
Local and non-Codex paths remain unchanged. Receipt:
`/private/tmp/codex-default-sandbox-target-fix-receipt.json`.

Unchanged saved setup choices now bypass only new-selection resolution, retaining
later secret, company/environment, authentication, and runtime validation. The
actual disabled legacy baseline returned 422 before its probe. Treatment passes
175 existing controls plus a native-provider switch negative, with server
typecheck. New, explicit, draft, and changed-harness choices keep the disabled
adapter policy. Receipt: `/private/tmp/pr2-disabled-saved-codex-owned-receipt.json`.

The actual served Codex guide reproduces stale Mac/ARM legacy text at `665c155`.
It now uses the shared GNU libc floor, lists qualified Linux/Mac architectures,
distinguishes legacy fields, and preserves existing-runner and failure semantics.
Adapter typecheck passes; the updated served guide needs final-preview proof.
These corrections update server setup/execution and guide source. The qualified
`a200495` package startup and historical task evidence retain their literal
component boundaries; no new managed live proof or paid turn is claimed.

Fresh review at `e79254b` verifies the preceding fixes and reports one valid
development override edge. The common remote resolver now preserves
`PAPERCLIP_RUNNER_BINARY` only when the measured target OS/CPU matches the
controller. Explicit remote overrides retain priority; every selected artifact
still requires a matching native header. Cross-target selection ignores the
controller override. Seven new baseline failures reproduce the defect; 133
target/setup/backend/retained/version controls and server typecheck pass after
the correction. Receipt:
`/private/tmp/codex-default-same-host-override-fix-receipt.json`.

The `e79254b` preview restart preserves all four configurations and both
historical native runs. Its actual served guide now reports the shared GNU floor
and qualified Mac/ARM targets. No native build, Docker build, or provider call
runs locally. Main CI's selector remains unallocated; other PRs share this queue.
No environment approval, owned concurrency conflict, or routing failure was
found. Org capacity versus GitHub allocation is unconfirmed. Receipt:
`/private/tmp/pr2-e792-selector-queue-investigation.json`. Required final CI
aggregates and fresh review remain pending, not passed.

Next action: require fresh CI/review on the final corrected candidate, refresh the
matched preview, and publish final conclusions in the canonical PR's evidence
index. Human code-owner approval, managed staging onboarding, and actual
post-merge Cloud composition remain outstanding. No merge or production
deployment is authorized. Historical unknown costs and cleanup holds remain
reserved; all Dockerfile/native builds stay remote.

## Current amendment: remote build performance and Linux baseline

The user requires Cargo dependency caching and overlapping JavaScript/native
preparation in the existing hosted jobs. Dockerfile and native builds must stay
off this Mac. Reuse the current child supervisor for concurrent commands and
failure/cancellation cleanup; join both outputs before source, header, signature,
and hash recording. Cache dependency crates only, keyed by target, OS baseline,
compiler, lockfile, and external contract inputs. Only canonical exact-source
master pushes may save trusted caches. Preview jobs restore only. Seventy-nine
workflow/process controls pass; actual speed or cache hits remain unproven until
the final hosted run. Receipt:
`/private/tmp/pr2-native-cache-parallel-owned-receipt.json`.

The exact `dcdf09a0f33536fa2b6daaf6e731d921d5711282` four-target qualifier
[38268767165](https://github.com/paperclipai/paperclip/actions/runs/38268767165)
has built all four actual daemons. Linux package installation passes, as does
the clean Apple Silicon consumer. ARM64 installs successfully but native session
startup fails; cleanup masked the original cause. Ordinary CI passes at that
source. Fresh review found a target-daemon
selection mismatch for cross-architecture SSH: an x64 controller could select
its own daemon for an ARM64 environment. The existing resolver/setup/execution
seams now select and verify the actual target header. One hundred four affected
controls and both typechecks pass. Setup and execution share the fix; missing or
wrong artifacts fail explicitly. Receipt:
`/private/tmp/pr2-native-ubuntu-ssh-owned-receipt.json`.

The existing installed startup fixture now preserves the primary error and
separately records cleanup failure. Fourteen controls and E2E typecheck pass.
Docker isolation, no-network policy, and zero provider turns stay unchanged.
Use the exact failed package artifact `11757308120` from run `38268767165` in
one disposable hosted ARM diagnostic job. Keep corrected tooling provenance
separate from its literal `dcdf09a` product source. Verify registry ZIP digest,
bounded archive members, source, and every package hash before using the
existing consumer. This temporary diagnostic ref adds no permanent test suite
or workflow inputs. The primary cause and final ARM startup remain unresolved.
Receipts: `/private/tmp/pr2-installed-startup-error-preservation-receipt.json`
and `/private/tmp/ci-final-dcdf09a-arm-startup-failure-receipt.json`.

Independent inert ELF inspection of both Linux artifacts at this revision
confirms required `GLIBC_2.39`, GNU loaders, `libc.so.6`, `libm.so.6`, and
`libgcc_s.so.1`. Neither binary was executed locally. The published Linux
baseline is therefore GNU libc >=2.39 on x64/AArch64. Pin current producers to
Ubuntu 24.04; clean consumers use the pinned Debian 13 Node image. Do not claim
older distribution/kernel qualification. Automatic new-agent selection rejects
measured older, musl, or unknown Linux libc; existing native configurations keep
their execution. Windows and Alpine/musl remain deferred. Receipts:
`/private/tmp/ci-final-dcdf09a-linux-arm64-data/elf-dependencies.json` and
`/private/tmp/ci-final-dcdf09a-linux-x64-data/elf-dependencies.json`.

The libc guard passes 209 focused controls and both typechecks. Seven actual
POSIX probe/version controls pass. Forty-one built-in database cases did not
execute because embedded PostgreSQL timed out on this Mac; require Linux CI.
Token gates pass with the pinned pnpm launcher. Receipt:
`/private/tmp/codex-default-glibc-floor-receipt.json`.

Next action: freeze corrected diagnostic tooling, identify and fix the actual
ARM startup cause, then require fresh hosted qualification, CI, and review. Keep
the current branch, PR, test-drive, budget holds, and no-Codex-bundling boundary.
No merge or production deployment is authorized.

Checkpoint `695506ad3912fa63604ca784fda50416fba983d6` is pushed and passes
ordinary CI (53 successful checks, four conditional skips). The restarted
test-drive serves `2026.1005.0+348.git.695506ad39`; four complete agent execution
configurations and both historical native runs survive unchanged, with the old
experimental flag false. Normal staging selects the verified Mac target and
reports `needsBuild: false`; there is no binary override or local Cargo build.
Receipt: `/private/tmp/pr2-final-preservation-after.json`.

The hosted [ARM diagnostic](https://github.com/paperclipai/paperclip/actions/runs/38273898742)
used tooling `695506ad` and the literal `dcdf09a` package archives. It recovered
the primary failure: Codex's bubblewrap cannot create a namespace inside the
restricted Docker fixture. Daemon/CLI installation and ABI were not the cause.
The existing consumer now retains that Docker install/lifecycle proof and
uses the same installed graph on the actual ARM host for unchanged read-only
startup. Lock, daemon, and official Codex command hashes must match across
Docker/host and before/after. Twenty-one controls and independent review pass.
No external-sandbox substitution, sudo, sysctl, namespace flags, or product
permission policy changes are used. Actual host capability still needs proof.
Receipt: `/private/tmp/pr2-arm-host-split-owned-receipt.json`.

Fresh review also found that the daemon's new libc gate had accidentally sent
older Linux browser login to PATH-only lookup. A two-file fix restores owned
Codex CLI resolution independently of daemon eligibility. One hundred twenty-four
focused cases and server typecheck pass; nine regressions fail before the fix.
Creation's libc floor remains unchanged. Receipt:
`/private/tmp/codex-default-login-libc-decoupling-receipt.json`.

Next action: freeze this corrected tooling and run one remote ARM host treatment
against the same verified archives. Require actual host startup before the final
four-target qualification; retain literal product/tool source identities.

The [host treatment](https://github.com/paperclipai/paperclip/actions/runs/38276826878)
at tooling `123a18837478d8cd0e2aff23f7e7aa86c9107de3` also fails native startup.
The actual ARM host reaches the installed daemon and Codex, then bubblewrap
fails loopback `RTM_NEWADDR` with `Operation not permitted`. No successful
native session or after-start continuity is claimed. Docker/host installation
identity passed. Exact upstream Codex 0.160 source places namespace creation
before its own seccomp filter and always restricts networking for filesystem
helpers. A Paperclip network-mode change would not solve this. Prepare one
temporary same-policy direct Codex control plus read-only host namespace facts
to distinguish host enforcement from native mediation. Do not alter kernel,
Docker, or product permission policy. Receipts:
`/private/tmp/ci-final-arm-host-diagnostic-123-receipt.json` and
`/private/tmp/codex-default-arm-sandbox-source-diagnosis.json`.

Fresh `123a188` review is 5/5 with one payload-continuity finding. The existing
consumer now hashes the actual official Codex native executable separately
from its launcher, checks containment/header, and compares both across Docker,
host, and before/after. Twenty-one controls pass, including native-only mutation
and an older supported package layout. Receipt:
`/private/tmp/pr2-native-codex-payload-and-control-preparation-receipt.json`.

Ordinary `123a188` CI found two test gaps. Nine new login fixture controls were
shadowed by Vitest's global module bridge. The existing bounded plain-Node
resolver seam now proves private package selection and containment before only
fake login; all 27 login cases and typecheck pass. A repository test reloaded one
millisecond after Save, before any update request reached the server. It now
awaits the real saved-value render, then retains the persistence assertion after
reload. No product repository code changes. Receipts:
`/private/tmp/codex-default-login-resolver-isolation-receipt.json` and
`/private/tmp/ci-final-123a188-repository-e2e-analysis.json`.

Next action: freeze these review/test fixes, run the bounded direct ARM control,
and require fresh Linux CI. Keep ARM startup sign-off unresolved until proven
on a compatible target; package installation and direct execution alone do not
qualify the native runner. All Docker/native builds remain remote.

Checkpoint `598e190cb308f4d7f8f43c188c2e7d88c3fc90d1` passes
[ordinary CI](https://github.com/paperclipai/paperclip/actions/runs/38279960223):
both required gates, 54 successful checks/statuses, and four conditional skips.
Fresh review is 5/5; all 15 review threads are resolved. Human code-owner approval
is still absent. The test-drive serves `2026.1005.0+350.git.598e190cb3`; all four
execution configurations and both historical native runs survive restart.
The verified Apple Silicon daemon remains unchanged, `needsBuild: false`, with
no binary override, native compilation, Docker build, or provider turn locally.
Receipts: `/private/tmp/ci-final-598e190-ci-review-receipt.json` and
`/private/tmp/pr2-final-preservation-after.json`.

The [direct/native ARM diagnostic](https://github.com/paperclipai/paperclip/actions/runs/38280515437)
records GNU libc 2.39, AppArmor enabled with restricted unprivileged user
namespaces, an unconfined current profile, zero effective capabilities, and no
seccomp filter. Native startup still fails at bubblewrap loopback `RTM_NEWADDR`.
The direct control stopped before Codex spawn at a TOML preservation guard,
so it does not establish the sandbox failure's cause. Receipt:
`/private/tmp/ci-final-arm-direct-diagnostic-598-receipt.json`.

Pure, integrity-bound public `smol-toml` 1.9.1 reproduction identifies that guard
failure: its null-prototype tables differ from the writer's spread-created
ordinary objects. Preserve the parser's tables while changing only the intended
trust field; keep strict comparison, original comments/bytes, private writes,
and malformed-input rejection. No parser pin, semantic bypass, or permission
change. The existing suite passes 22 controls across both table representations;
real 1.9.1 treatment repairs five valid configurations and keeps two invalid
configurations unchanged. Runner/server typechecks pass. Receipt:
`/private/tmp/codex-default-startup-trust-fix-receipt.json`.

The [four-target performance qualifier](https://github.com/paperclipai/paperclip/actions/runs/38281631416)
uses literal `598e190` product/workflow source. Observed Linux x64/ARM64 and Apple
Silicon builds pass with actual concurrent JavaScript/native preparation.
Cache restore is exercised; observed results are cold misses, not measured
speedups. The cache writer is reachable through the existing verified master
canary push, with exact source and repository guards; no write-gate expansion
is needed. Linux daemon bytes match the measured GNU 2.39 baseline. Remaining
producer/consumer results must be recorded before qualification claims.

Next action: freeze the narrow trust correction, repeat the bounded direct
control with explicit corrected-tooling provenance, and retain native startup
as mandatory. A private namespace negative control and bounded read-only
AppArmor journal may help distinguish host denial. Do not modify host policy,
relax Codex's sandbox, or substitute direct execution for native qualification.
Require fresh CI/review after the correction. ARM startup and managed staging
remain unresolved; no merge or production recommendation is made.

The frozen production checkpoint `a200495cc7488f4d59da570407e516cf702e5af8`
passes [CI](https://github.com/paperclipai/paperclip/actions/runs/38283122068)
(54 successful checks/statuses, four conditional skips) and fresh 5/5 review;
all 15 review threads are resolved. It serves the test-drive at
`2026.1005.0+351.git.a200495cc7`, with four complete agent configurations and two
historical native runs unchanged after restart. No local native/Docker build
or additional provider turn ran.

Its [exact-source qualifier](https://github.com/paperclipai/paperclip/actions/runs/38283695248)
builds and verifies all four daemons. Linux clean installation and both actual
Mac native startup/cleanup consumers pass. Cache restores are real cold misses;
JavaScript/native preparation overlaps on all four producers. The unchanged
host's ARM startup fails at AppArmor's namespace capability restriction, so that
original run remains failed. Public artifact `11763536756` contains the verified
18-package graph. Receipts: `/private/tmp/ci-final-a200495-hosted-qualification-receipt.json`
and `/private/tmp/ci-final-a200495-cached-producer-observations.json`.

The separate [stock-prerequisite ARM treatment](https://github.com/paperclipai/paperclip/actions/runs/38287918968)
passes actual native startup, default daemon resolution, model selection,
read-only context, and joined cleanup on the exact same packages. Lock, daemon,
official Codex launcher, and native payload hashes match before/after. GNU libc
is 2.39. Global AppArmor enforcement, namespace restriction, and clone setting
remain Y/1/1. Authenticated Ubuntu package files provide system bubblewrap and
its reviewed stock scoped profile. Only those files are materialized; no package
maintainer scripts, sysctl writes, or broad profile reload runs. This is a
qualified target prerequisite, not a product permission-policy change.
The user has no other QA ARM host. No new paid environment was provisioned.
Receipt: `/private/tmp/ci-final-a200495-arm-stock-prerequisite-receipt.json`.

Keep the boundaries explicit: normal OS APT installation is unproven; the actual
Paperclip npm installation and native startup are proven. The separate direct
control hits a read-only temporary-home error and is excluded from native
qualification. No ARM paid task/follow-up is claimed. Actual Apple Silicon
useful-task/follow-up evidence remains tied to its recorded source and identical
verified daemon bytes. Existing agents keep their runners.

The tested setup body is integrated as
`scripts/prepare-linux-arm64-qualification.sh`, with an early hosted-Linux guard.
The existing ARM-only qualification step invokes it before the existing consumer
and uploads its report through the same artifact pipeline. Four focused workflow
and guard controls pass; syntax and diff checks pass. Receipt:
`/private/tmp/codex-default-arm-prerequisite-ci-integration-receipt.json`.

Next action: require latest-head CI/review and one hosted consumer against the
unchanged `a200495` production packages using the integrated helper. Production
code remains frozen there; subsequent edits are qualification tooling or
documentation and retain separate source identities when reusing those literal
package archives. Managed staging, human
code-owner approval, actual post-merge cloud composition, and production sign-off
remain outstanding. No merge or deployment is authorized.

## Current addition: Linux ARM64

The user now requires ARM Linux support as well. Treat ARM Linux as ARM64
(`aarch64`), alongside Linux x64 and both macOS architectures. The earlier
Linux ARM deferral below is superseded for ARM64; 32-bit ARM and Windows retain
legacy defaults. Existing agents keep their saved execution.

Extend the same native Codex creation/discovery contract and existing selection,
login, built-in and plugin fixtures. Extend the current release assembler and
remote workflow matrix to the fourth target, with an actual ARM64 hosted build
and clean installation. Reuse the installed no-turn Codex startup check and
the same public npm tarballs. Read required targets from the selected source
so historical three-target promotions still work. Keep the Linux x64 managed
provider pack distinct from the local ARM64 daemon.

No local Rust/Docker builds or new paid Linux campaign. Apple Silicon task and
follow-up acceptance remains valid at the explicitly recorded source; Linux
ARM64 build/install/startup must acquire its own evidence. The existing
[three-target qualifier](https://github.com/paperclipai/paperclip/actions/runs/38259364638)
completed successfully at `d522822`, including both clean Mac consumers. It does
not qualify ARM64. Candidate `058af8f1b69c5fa3d9bc974b9eab73c141b52823` passed
ordinary CI and fresh 5/5 review. Its remaining import display finding is fixed
by sharing the existing legacy argument-policy calculation with the UI without
changing execution permissions. Ninety-five focused controls pass; all 45 exact
argument cases also pass against the original builder. Four component cases fail
on the original page. A no-provider protected preview shows Legacy with bypass
off, matching `--sandbox read-only`; it does not apply another import.
Receipt: `/private/tmp/codex-default-dc-import-live/legacy-policy-p2-receipt.json`.

ARM64 selection/discovery controls pass 46 and 29 cases. Fourteen isolated
browser-login tests pass after replacing the hardcoded ARM64 legacy login branch
with the shared platform contract. This uses native execution's owned Codex
resolver on ARM64 and retains PATH lookup for unqualified platforms. Shared
typecheck passes. Built-in and plugin fixtures now include ARM64; their database
checks remain in normal Linux CI. Receipt:
`/private/tmp/pr2-linux-arm64-selection-checkpoint.json`.

The packaging patch passes 97 existing controls: 15 assembler/provider-pack,
20 consumer-boundary and 62 workflow tests. The first full workflow attempt was
blocked by sandbox localhost permissions; the same full suite passes with its
temporary listener access. Three workflow YAML files and MJS/shell syntax pass.
Independent review confirms historical source compatibility and the unprivileged
offline consumer boundaries. Official registry metadata confirms the pinned
Node image has a native ARM64 manifest and the installed Codex dependency has
an ARM64 package. No image or binary was pulled to this Mac. Receipt:
`/private/tmp/pr2-linux-arm-packaging-owned-receipt.json`.

Actual ARM64 daemon build and clean npm/native startup remain unexecuted at this
source freeze. The test-drive stays on its existing verified Mac daemon; its
last restart at `058af8f` preserved both full execution digests, both recorded
native runs and both paused imports, with the deprecated flag false. Receipt:
`/private/tmp/codex-default-dc-import-live/final-restart-receipt.json`.

Next action: integrate the narrow policy display and ARM64 source/package fixes,
run targeted controls, freeze/push one candidate, then run the existing hosted
qualification once with all source-declared targets and require fresh CI/review.
Keep the same branch, PR, preview and evidence index below. No merge or
production deployment is authorized.

## Current amendment: include macOS in this PR

The user requires macOS support in the same Codex-default PR. The earlier
Linux-only scope and macOS deferral below are superseded. Qualify Linux x64,
macOS arm64 and macOS x64 through the shipped package path. Windows and Linux
ARM keep their legacy defaults. Existing agents retain recorded execution.
The user explicitly invoked `dotta:paperclip-test-drive`. Real task/follow-up
acceptance is required on this Apple Silicon Mac. Intel builds must be attempted;
an attended Intel provider journey is not required. Reuse the healthy test drive
and the existing Product E2E helpers rather than create another test system.

Keep the current PR and branch: [#15683](https://github.com/paperclipai/paperclip/pull/15683),
`codex/codex-runner-default`. The Mac qualification source is
`d522822a5daeb72d124360b576b82a8bb52b43f4`; its
[ordinary CI](https://github.com/paperclipai/paperclip/actions/runs/38259205327)
is green. Fresh automated review is 5/5. The development release-manifest
finding is fixed with focused tests and awaits fresh final-head review.
Earlier Linux-only source `6ca302426b768791b499d2d563bbca4276f2c908` had fresh
5/5 review and eight resolved threads. That historical review does not qualify
the macOS amendment. Master integration conflicts are resolved.

The [test-drive server](http://127.0.0.1:3125/COD/agents/all) is running through
the normal dev supervisor at the Mac qualification source. Health and bootstrap
are ready; the actual listener belongs to this worktree. The preserved legacy
and new native Codex QA agents are idle, with unrelated title edits intact. Dependencies
and ignored configuration had been cleared, so startup restored them and the
normal CLI signing keys while retaining the database and encrypted account key.
The initial borrowed development daemon was removed before paid testing.
The production resolver selects the source-bound CI arm64 daemon. Both native
task runs and restart preservation use the verified runtime below.

Implementation ownership:

- Packaging worker: reuse the existing daemon assembler, release verification
  and release-smoke workflows to produce source-bound Linux and both macOS
  artifacts. Pack the normal npm graph, then test those same tarballs on actual
  Mac hosts. Retain the Linux and provider-pack controls. Never bundle Codex
  native payloads; use the installed official npm dependency and real protocol
  compatibility. Compile Rust and Docker only on remote hosts.
- Selection worker: extend the shared availability contract and existing
  creation, onboarding, discovery, approval, import and UI fixtures. Preserve
  explicit legacy choices, external overrides and existing execution.
- Runtime worker: verify the existing Mac native launch, account isolation,
  file delivery and continuity seams; fix only actual gaps. Keep the Linux-only
  sandboxed workspace-command capability gated on unsupported platforms.
- Lead: integrate, run targeted and required checks, verify useful Mac native
  task/follow-up artifacts and ordinary editing, refresh the test-drive on the
  verified revision, and update the same PR and evidence record.

Reuse existing evaluations and assertions. Provider-free packaging and protocol
checks do not substitute for authenticated task completion. Preserve the $250
ceiling and historical unknown/cleanup holds; reconcile only documented
unstarted future reservations before any new provider turns. No additional
paid Linux campaign is authorized by this amendment. Embedded-browser-only
login, no automatic agent migration, and no merge or production deployment
remain constraints.

The macOS source checkpoint is `7b8d29a856b54217234131474ea47ea1a38fb0aa`.
The frozen master integration target is `b189f586d2f01c078725193b8a5ce4372b4acb3d`.
Conflicts are being reconciled by file ownership, retaining the newer transport,
lifecycle and release verification fixes. Focused macOS selection, installed-hook,
file confinement and packaging controls pass. These are source/protocol controls,
not real provider execution. The existing saved OpenAI subscription is connected.
The ordinary production agent-config render suite passes 111 cases after its merge.

Budget reconciliation assigns $3 of the documented unstarted $5.50 managed
reservation to Apple Silicon native test-drive acceptance, leaving $2.50 for the
managed journey. The completed legacy subscription journey's entire $2.50 hold
remains reserved as unpriced. No historical unknown or cleanup reserve is released;
the $250 ceiling and $248.18 combined cost/reservation total remain unchanged.
Limit the Mac journey to two task turns, 180 seconds each, no automatic retry,
and an independently checked useful file plus revision.

### Mac acceptance checkpoint

The real [Apple Silicon task and follow-up](http://127.0.0.1:3125/COD/issues/COD-2)
passed at runtime source `f4abdc2cfcd779d5ad9b9c0ea8b63114c1a18a9b`.
The ordinary picker submitted `codex_local` without a runner override and saved
`paperclip_runner` / `codex`. Saved subscription reuse and native setup passed.
Both task runs succeeded with driver `codex_app_server`, observed model
`gpt-5.6-sol`, and the same provider session. Independent attachment downloads
verified exact 61-byte and 102-byte Markdown files, including preservation of
the first attachment. Reload retained the native configuration.

The actual owned daemon process loaded the source-bound CI bytes:
`sha256:d0656673f7b6dfa6f2554fac18f3e0b42e2eb10f444b06f6063255335d71aa14`.
Mach-O arm64, production contract, source receipt and code signature passed.
The borrowed development daemon override was removed. Startup at this revision
preserved the old legacy agent's full execution digest. Unrelated UI title edits
and reload preserved complete legacy/native execution digests; the shared runner
picker passed light/dark, mobile and keyboard checks. Screenshots and sanitized
receipts are under `/private/tmp/pr2-f4-mac-ui/`.

The corrected qualifier's exact `d522822` Apple Silicon artifact independently
matches those same bytes and metadata. Artifact `11752770004` passed native
header, source receipt and strict ad-hoc signature checks. Rust tree
`6ca713d5f1f0a059c7f01a37d21f268817e0c93c` and runner TypeScript tree
`ba9744db7fe79301cb0ab442e9546de3282a4bf4` are identical to the paid-task source.
The receipt is `/private/tmp/pr2-d522-mac-remote-daemon/sanitized-verification-receipt.json`.
Restarting the test-drive at `d522822` preserved both complete execution digests,
titles and both native run records, with no additional provider calls.

The deprecated `enableNativeRunner` field is now false on this QA instance.
The native export/import UI journey passes with that field disabled. Import
submission omitted adapter overrides, preserved native Codex/model identity,
and left the new agent paused with its import hold. The explicit Legacy round
trip also passes: the request sends `runner: legacy` without replacing source
configuration, and the saved agent is `codex_local` with the import hold intact.
Both survive reload; the source agent remains unchanged. These imports do not
run setup probes or provider turns.
Evidence is under `/private/tmp/codex-default-dc-import-live/`.

The live import journey found one incorrect policy display. Native Codex's
preserved `never` policy translated to Legacy bypass true, while its checkbox
showed false. A narrow hydration fix uses the existing policy defaults and
canonical booleans; it does not change server permission translation. Against
the pre-fix page, three display cases fail and four safe controls pass. The
fixed page passes 42 component cases and 40 selection controls. The no-provider
preview check passes: the corrected control matches the already-saved paused
agent. Exactly two paused imports were submitted, with no third Apply. The
combined receipt is `/private/tmp/codex-default-dc-import-live/receipt.json`;
it separates `d522822` persistence proof from the corrected UI's content hashes.

[Three-target qualification](https://github.com/paperclipai/paperclip/actions/runs/38252137381)
built all three daemons, including actual Intel Mac. Its clean Linux consumer
passed the 18-package installation and Codex ownership controls, then a Pi probe
failed because it expected the old flat daemon path. Both Mac consumers reached
deferred offline lifecycle scripts but Node-gyp tried a forbidden header download.
Narrow verifier corrections preserve the startup/network/lock/sentinel assertions
and use the host SDK. These failed attempts remain evidence; installed-package
qualification still requires a passing corrected run.

Test-only head `dc7304d7c4db1c9c9ee2ed80a98d004371372771` is production-byte
identical to `f4abdc2`. Its [ordinary CI](https://github.com/paperclipai/paperclip/actions/runs/38253941991)
passes the required checks. Two fixture repairs enabled Dot only in its intended
experiment cases and restored owner directory permissions only inside each test
worker's scratch home for teardown. The actual asset producer/symlink control
passed. Fresh review identified import override/availability gaps and stale dev
host binaries. Their fixes now pass 38 real-component import cases (eight fail
on the old page) and 12 dev-stager/freshness controls. Unknown/gated providers
retain their identity. Rebuilding refreshes an existing host target atomically
and keeps a running old executable intact. Fresh final-head checks/review remain
required. The corrected Pi/Mac installation probes pass 19 focused controls
and independent source review; actual hosted consumers remain pending.

The two native runs report included subscription use without a dollar amount.
The complete $3 setup/task hold remains reserved as unpriced. No historical
unknown or cleanup hold was released, no automatic retry ran, and no additional
paid Linux campaign started. The aggregate ceiling remains $250.

The import, dev-stager and installation-probe fixes are pushed at `d522822`.
The [corrected three-target qualifier](https://github.com/paperclipai/paperclip/actions/runs/38259364638)
has passed all three daemon producers and the real Linux clean installation,
including the corrected Pi probe. Both Mac consumers are checking the same
18 tarballs. Ordinary CI reports 53 successful check runs, Snyk success and four
conditional skips. Fresh review reports 5/5, with one new development-only
manifest issue: rebuilding a host daemon must not corrupt released artifact
identity. Its fix separates local development selection from release assets;
it does not alter the Rust runner, production selector or release assembler.
Fourteen focused controls prove preserved release targets/hash manifest, running
old inodes, correct Mac host selection and future source freshness. Independent
review verifies that the atomic flat publisher and qualified release components
remain unchanged. The actual Mac still selects the verified release target and
does not require Cargo. Receipts are
`/private/tmp/pr2-dev-release-preservation-checkpoint.json` and
`/private/tmp/ci-final-d522-dev-equivalence-audit.json`.

Next action: commit the verified development/import display fixes and this state
record together. Run fresh final-head CI/review in parallel with the remaining
clean package consumers, then record their exact conclusions in the PR evidence
index. Keep `d522822` as the qualification source; subsequent UI/development
checks have their own source identity. Keep exact sources in every receipt.
Do not repeat unchanged paid task turns or qualification components merely for
the development-only fix.

This is the 2026-10-12 source-freeze snapshot. The PR verification section is
the linked evidence index for final CI, review and consumer conclusions. Current
qualification links above retain their literal tested source rather than claim
that an earlier workflow ran on a later development/UI commit.
Managed staging execution/access renewal, code-owner approval and actual
post-merge Cloud composition remain unverified. Prior staging preflight evidence
is retained at [37962635959](https://github.com/paperclipai/paperclip/actions/runs/37962635959)
and [37965658123](https://github.com/paperclipai/paperclip-cloud/actions/runs/37965658123).

## Outcome and ownership

Users choose a harness. New agents use Paperclip Runner where the harness and
execution target are qualified. Existing agents keep their recorded runner.
The task owns implementation, verification, review fixes, and reviewable PRs.
Merging and deployment require separate authorization.

The original implementation is preserved on `codex/default-agent-runner` at
`171d841295808ca185a258aaeb10b3dee68bb2b9`. Its public review is
[PR #15422](https://github.com/paperclipai/paperclip/pull/15422).
The user approved splitting that work into four useful steps:

1. Packaged runtime reliability and Codex prerequisites, without changing defaults.
2. Codex defaults across creation, onboarding, hiring, imports, and the UI.
3. Claude defaults and authentication.
4. The remaining supported harness defaults and provider-specific fixes.

## Completed prerequisite

[PR #15555](https://github.com/paperclipai/paperclip/pull/15555) merged at
`6f9d0a56ba3c2f0059a723b7de434320eed7eb22`. Its final candidate `dde37d7`
passed 47 ordinary CI jobs and fresh 5/5 automated review. The actual clean Linux
npm consumer checked all 17 tarballs for absent Codex native payloads and official
npm host dependencies. Actual Codex 0.156.1 startup passed on macOS ARM64.
[Bot lockfile refresh #15673](https://github.com/paperclipai/paperclip/pull/15673)
is merged. These checks did not qualify onboarding or cloud rollout.

Removed prerequisite work remains on `codex/runner-packaging-full-snapshot` at
`6f3060beaa842ffcee21af058370d3cab5f571e9`. Do not restore its release workflows,
Docker materialization, Git installer, or extra login isolation wholesale.

## Current slice: Codex defaults

Authorized 2026-10-09. Canonical branch: `codex/codex-runner-default`.
Integration base: master `2dd9811e8be1dab59cccd86cdb25e8953b02fe07`.
Canonical PR: [draft #15683](https://github.com/paperclipai/paperclip/pull/15683).
Last pushed candidate: `ad5d8826ad18f72d672fcafbdd9fec24ef8c9fef`.
It integrates the current agent lifecycle boundary. The next narrow follow-up
restores the native Codex sign-in action and settles an existing chat test's
canonical lookup before interaction. The PR remains under 100 files, with no
workflow, lockfile, or database migration changes. Fresh final-head CI and
review are required after that follow-up.
Preview: [isolated Codex QA](http://127.0.0.1:3125), normal dev supervisor,
separate database. Hosted Linux live onboarding passed at `38199ea8`; it remains
historical proof after the lifecycle integration. UI has separate revision-bound proof.
Attended local subscription and managed staging journeys remain unverified.

New Codex agents select Paperclip Runner on qualified Linux x64 targets. Users
choose Codex, with Paperclip Runner or Legacy runner inside Advanced. Other
harness defaults stay unchanged. Existing legacy/native agents and ordinary
edits retain recorded execution; explicit runner changes use revisions/session
invalidation. No database migration or permission-policy change.

Resolve before validation/auth/instructions/skills at the common creation
boundary. Cover direct/API/CLI creation, onboarding seeds, hires, frozen
approvals, built-ins, plugins, and import/export. Unsupported platforms or active
external overrides retain legacy selection. Missing dependencies, invalid models,
authentication failures, and incompatible settings remain actionable errors,
without silently choosing another runner. Native Codex bypasses the experimental
gate; other native providers retain their existing gate.

Finish line: one narrow reviewable PR, affected regressions and required checks
passing, useful Codex tasks plus follow-up and independently checked artifacts,
onboarding and existing-agent preservation verified locally and on qualified
managed staging, and inspectable evidence. Human merge and production deployment
remain separate actions. Actual production composition remains a post-merge gate.

## Coverage and execution ownership

Reuse Product E2E profiles, fixtures, graders, reports, and installation checks.
The `first-task` native Codex case now inspects the wizard's saved default directly
with the experimental flag disabled. The legacy control selects its override
before authentication. Each isolated onboarding company has a $5 task budget;
setup probes require their own reserved allowance.
Claude's explicit native fixture is unchanged until its later default PR.

| Area | Owner | Current state |
| --- | --- | --- |
| Shared contract, server resolution, setup readiness | Core worker | Integrated lifecycle: 210 core cases, 109 connection cases and five affected refresh controls pass; server noemit passes; counts overlap |
| Production create/edit/onboarding UI and stories | UI worker | 171 fresh focused cases, 30 desktop/10 mobile captures and six keyboard checks; built-in follow-up passes 15 cases, UI typecheck and token gates |
| Built-ins, plugins, approvals, imports/exports, CLI | Creation-path worker | Integrated lifecycle: 105 portability, eight approval and three asset cases pass; 73 DB cases skipped on macOS; final Linux checks required |
| Execution/dev gate, E2E gaps, packaging, live journeys | Lead | Selected Linux onboarding case passes all 13 assertions, actual task/artifact/follow-up and cleanup; 149 public-projection/support cases pass |
| Full CI and final review | Lead | Integrated head: 49 checks pass, three fail, four skip; native auth action finding and existing chat readiness fixture fixed locally; fresh combined-head checks/review required |
| Local subscription task + follow-up | Lead | Embedded-browser Codex sign-in and first-agent creation completed; saved codex_local is expected on macOS; useful task/follow-up still pending |
| Managed staging API/subscription onboarding | Lead | Fleet Admin sign-in completed; dedicated tenant exists, active/awake and pinned to old release; scoped one-hour QA owner access approved; final serving revision/snapshot/runtime/cleanup qualification pending |
| Shipped npm/Docker/cloud artifacts | Lead | Integrated-head clean Linux npm consumer passes: 18 packages, no Codex payloads, host dependency from official npm; immutable staging preparation reports missing matching DB package; actual cloud composition is post-merge |

Keep CPU-heavy Rust/Docker builds in hosted CI. Use Node 24, bounded workers,
conservative provider turns/timeouts and existing QA accounts. Login interactions
use the embedded browser. Do not change user preview services or production.

The original $250 ceiling remains. Historical receipts include unknown-charge
reserves; the latest retained ledger holds $248.18 in costs/reservations and
reports $1.82 unallocated, not a certified invoice balance. Reconcile unstarted
reservations and current resource/credential state before paid runs. Do not reset
the ceiling or treat missing charges as zero. The single new Linux campaign has
four ready rate-card estimates totaling $1.265460800; its entire $12 hold remains
reserved. Keep exact source/artifact/runtime identities and failed attempts in the
existing report pipeline; mocks and passing CI do not close live acceptance.

Integration found and fixed an import preservation gap: same-harness model edits
must retain the package's explicit runner or the existing agent's runner. Native
setup reuses production remote artifact preparation and verifies the actual
app-server/model path; a version number alone does not reject installed Codex.
Known unsupported local/SSH platforms retain legacy defaults. Sandbox support
does not infer an image architecture; setup verifies its actual artifacts.

Public package audit found flat Linux x64 daemons in current stable and canary
server tarballs. Normal release builds stage only the build host's daemon; the
multi-platform assembly helper has no release caller or macOS artifact producer.
Automatic macOS/Windows/Linux ARM defaults therefore remain legacy in this slice.
Existing explicit native agents remain usable with their installed runtime.
macOS runner artifact assembly is a separate prerequisite for its default.
Codex setup required three small Rust seams: read-only probes, observed model
reporting, and reasoning effort. Old cached daemon bytes do not verify these.

Local startup hit the macOS shared-memory ID limit. One detached 56-byte segment
was released only after zero attachments and exited owners were verified. No
running server or database file was changed. The separate QA server is healthy.

Next action: verify the final candidate through existing Linux CI/install checks,
fresh review, and bounded actual journeys. Preserve
failed attempts and costs. Unrelated findings and remaining harness qualification
belong to later slices.

Post-rebase UI checks pass (126 cases, typecheck, token gates). Product E2E
catalog/onboarding support passes (122 cases), plus 47 confirmation fixture
checks and E2E noemit. Existing Pi companion/executor controls pass (26 and 34
cases); core selection/setup passes 87 cases and transport passes six.
Production Storybook build and 26 desktop/six mobile captures were completed
before the Pi rebase; they are component evidence, not live execution proof.
Both final integration gaps are implemented: discovery resolves the selected
environment through the same helper as saving, and explicit native export/import
profiles remain valid on macOS while new automatic defaults stay legacy.
Scoped discovery/authorization passes 63 checks. UI context and recovery checks
pass 280 cases plus three final regressions. Missing discovery metadata shows
loading or the server error with Retry; explicit Legacy remains available.
Final portability checks pass 105 cases; approval, built-in asset and CLI unit
controls pass eight, three and three. The 72 skipped DB cases still need Linux.
Candidate `b7194275e` completed 38 CI checks but failed 14, including aggregate
checks. Its fresh review reported three P1 findings. The fixes preserve explicit
legacy sandbox policy, return refreshed unmanaged subscription credentials to
their authorized source account, and restore gated experimental native choices
for other providers under Advanced. Actor restrictions now run before harness
translation and again on the resolved configuration. Existing route fixtures
use the real resolver; legacy execution controls request Legacy explicitly.
Capability drift was fixed by preserving existing documentation heading anchors,
without changing generated contracts. The retired Codex flag control now uses
an experimental OpenCode profile; all 45 corpus regressions pass locally.
Core regression checks pass 394 cases, with 147 final guard/inheritance controls;
server noemit passes. UI checks pass 212 cases, typecheck and token gates. The
original touch/wheel journeys pass two cases against the isolated preview.
Final desktop/mobile/keyboard captures and the Advanced experimental story are
being checked against the frozen UI tree. Earlier 26 desktop/six mobile/three
keyboard checks passed on the previous UI revision. The built-in regression
checks nondefault settings through runner-only switches in both directions.

Exactly $22 of documented unstarted staging reservations were reassigned to
Codex-only proof: $12 Linux onboarding (one existing campaign, at most two
attempts), $5.50 managed onboarding, $2.50 attended local proof, and $2 incremental
compute/cleanup. The attempted $5 staging setup envelope remains an unknown-cost
hold. Aggregate costs/reservations stay $248.179254104 under the original $250
allocation; no historical unknown or cleanup hold was released. This is not an
invoice-certified balance. No new paid provider task has run in this slice.

Attended local Codex login is unfinished in the embedded browser; its old device
code expired. Staging Fleet Admin requires fresh attended sign-in. The dedicated
QA stack `stack-pool-d06dca5eafe7` and its old immutable environment are identified
historically; current access, serving revision, retained snapshot and physical
cleanup must be verified before reuse. Old archived probe resources and missing
compute billing remain unresolved. Do not substitute old artifacts or passing CI
for these live gates. The next candidate must pass fresh CI and review before
merge sign-off; actual private cloud composition remains post-merge work.


### 2026-10-09 Codex-only candidate qualification update

Frozen execution candidate `38199ea8e6a276eecd35084ad84d691322aba9f4` is rebased
onto master `835a022936ddc7a152b9feab0c0420d02249a6d1`. Its CI completed
48 passing, four failing and four skipped checks. The two substantive failures
are test fixtures: legacy skill expectations on Linux and a credential probe
that depended on a developer daemon. Their narrow corrections pass locally:
77 native/legacy/onboarding skill route cases and the selected-login refresh
regression. The earlier Node 26 skill run ended without a result; it is not proof.
Build, workspace typecheck, all browser E2E shards, policy checks, native
compilation, and the clean public npm consumer pass. The consumer checks all
18 packed packages contain no Codex payload and acquires host Codex from official
npm. The merge and generated-lock CI stamps are recorded separately from source.

The existing Linux Product E2E campaign [37950165589](https://github.com/paperclipai/paperclip/actions/runs/37950165589)
passed its only selected case on attempt one, without a retry. The ordinary
onboarding picker saved `paperclip_runner` / `codex`. All 13 assertions passed,
including an independently checked nonce-bearing document and follow-up with
recorded native execution and the same workspace. Four runs succeeded with
observed model `gpt-5.6-sol`; cleanup passed. Target source is exactly `38199ea8`.
The workflow deliberately applies its verified resolved lock; the source receipt
is dirty and must not be described as a pristine checkout. The report selected
one of 52 catalog cases; it is not the entire catalog qualification.

The final run ledger contains four ready rate-card estimates totaling
$1.265460800 (openai-standard-2026-09-30). Production pricing and accounting
settled. The existing E2E numeric-only cost summary omits decimal-string
costUsdExact and incorrectly reports unpriced/zero; this is a reporting follow-up,
not a production pricing failure. The full $12 campaign hold remains reserved for
setup and invoice uncertainty. Estimates are not provider invoices. No further
paid campaign was dispatched.
The existing public report includes private session identifiers in its result
summary. It is withheld from broad linking while an allowlisted public projection
is added at the existing result seam. Private artifacts and behavioral grading
remain intact. This is an evidence-publication correction, not new eval machinery.

Fresh review scored 3/5, verified the previous three fixes, and found three UI
edge cases: preserve original native setup-link intent on unqualified hosts;
retain built-in settings on runner-only changes; and record an explicit choice
when clicking the displayed automatic default. These fixes pass 171 focused UI
checks, typecheck and token gates. A fresh static build passes; affected visual
proof is in progress. Existing UI verification passed 28 desktop/eight mobile
renders, six keyboard/footer cases and two touch/wheel journeys. Final CI/review
must run after this combined follow-up is frozen.

The isolated preview uses [3125](http://127.0.0.1:3125/COD/dashboard).
Its supervisor uses the correct port and the prior backend restarted at
`2026-10-09T15:28:08.305Z`. No user preview or the separate OAuth proxy was stopped.
The owned supervisor/backend were gracefully paused during lifecycle integration;
restart and serving-source verification are required before another live journey.
The first-agent name draft survived reload. The cached local daemon is not proof
of the new native Rust seams; Linux hosted build/live execution supply that proof.
Attended subscription login and current access to the dedicated managed staging
stack remain unresolved. Canonical issue coordination is unavailable because the
original test-drive service is offline; no unrelated company was used for updates.

Public-evidence projection is complete and passes 149 existing and new support
checks. The private behavioral grader and raw evidence remain intact. Replaying
the retained result removes all 12 known private identity values and preserves
the original revision and all 13 assertion verdicts. Publication needs a new
presentation identity and operator access; the existing protected workflow has
no report-only replay input. It cannot overwrite the prior immutable report.
The prior exposed report also needs operator removal/cache remediation. No
provider rerun is justified to publish repaired evidence.

At `1be8502f`, fresh review confirms all six previous fixes and reports one more
built-in setup issue. A built-in that still needs setup must submit its displayed
configuration to complete setup even when the model is unchanged. Already
configured agents must still preserve the full saved configuration during a
runner-only edit. Both native and legacy regressions reproduced before the fix.
All 15 focused cases pass after the fix, including definition-model fallback and
ready/paused settings preservation. UI typecheck and token gates pass. Rendering
is unchanged, so existing revision-bound visual evidence remains applicable.
Native compilation passes; the main CI cleared its allocation delay and is
running, with no test failure observed yet.

Next action: freeze the built-in setup follow-up, require green
exact-head CI and fresh 5/5 review, and publish sanitized retained evidence when
operator access is available. Complete the attended and managed staging journeys
when their remaining resources are ready. The PR stays
a draft and is neither merge-ready nor production-ready yet. Merge and production
deployment remain outside authorization.

### 2026-10-09 Current-master lifecycle integration

Master merged [#15631](https://github.com/paperclipai/paperclip/pull/15631) during
qualification. GitHub blocked the new candidate on nine real merge conflicts.
The integration preserves master's agent lifecycle ownership. Common runner
resolution now runs in `prepareAgentHire`; approval activation retains the frozen
reviewed runner, responsible-user identity and credential restrictions. Existing
agent updates keep their saved execution. Obsolete source edits were removed,
and redundant generic API prose was dropped while the agent-creation skill and
its reference retain the complete runner contract. The diff remains 99 files.

Focused integration checks pass: 210 core, 109 connection, five affected refresh,
105 portability, eight approval and three built-in asset cases. Counts overlap.
Server noemit and the existing lifecycle-boundary scanner pass. Shared, DB and
plugin SDK JavaScript outputs were refreshed without migrations, Rust or Docker.
The 73 DB-heavy cases were skipped on macOS and require hosted Linux proof.
The full local route-fixture attempt was interrupted and is incomplete evidence;
loopback restrictions were identified before its bounded affected-case rerun.
That unrestricted rerun passes all 61 selected cases; 108 unrelated cases were
excluded and remain part of required full hosted CI.

The human completed Fleet Admin sign-in. The dedicated QA stack exists and is
active, awake, healthy and user-managed, so ordinary fleet rollouts skip it.
It still serves historical Core `2dbe43a4`, not this candidate. The human approved
one hour of scoped owner access for this QA tenant through the audited admin flow.
No release change, provider task, new image or fleet-wide action has run here.

Next action: freeze/push the integrated candidate,
require exact-head CI and fresh 5/5 review, restart the matched local preview and
qualify the dedicated managed target against that candidate. The previous Linux
run is retained evidence; it must not be relabeled as the new live measurement.

### 2026-10-09 Integrated-head qualification and final corrections

At `ad5d8826`, all checks completed: 49 pass, three fail and four skip. Required
verification, workspace typecheck, build, Linux server/DB suites, native
compilation and the real clean 18-package consumer pass. The consumer contains
no Codex payloads and selects its owned official-npm Codex dependency despite a
different outer version. CI merge and generated-lock identities remain separate
from the PR source. Applicable code-owner approval is still unproven.

The only browser failure is the existing selected-run denial case, whose fixture
uses the process adapter. Its URL becomes canonical before its agent query
settles. The test now waits for the successful company-scoped canonical response
and verifies its complete agent identity before clicking. All nine existing
retry cases pass against the real isolated preview with their exact request and
denial assertions unchanged. A supporting query lifecycle control reproduces
lost mutation feedback during a remount; the CI cause remains an inference,
because the controlled early-click browser reproduction did not activate.

Fresh review scored 4/5 and found one native Codex onboarding defect: an
authentication error lacked the shared check that displays the sign-in action.
The missing check reproduced before the fix. The correction retains the native
diagnostic, failed result and explicit runner choice. All 174 readiness, registry
and production-form render cases pass, including selected-environment login and
negative model/dependency controls; server/UI typechecks pass. The agent creation
skill retains the full API contract and CLI equivalents in one place, avoiding a
redundant reference edit and keeping the PR at 99 files.

The attended embedded-browser Codex sign-in succeeded, and first-agent onboarding
created the isolated Mac agent as `codex_local`, as expected on this platform.
The ordinary first-task interaction is open; task, artifact and follow-up are
not yet proven. No task provider call was made during these corrections.

The dedicated staging tenant's old release remains unchanged. Read-only
immutable preparation [37959487896](https://github.com/paperclipai/paperclip-cloud/actions/runs/37959487896)
matched the intended QA target and reported a matching DB package/migrations
artifact gap. Rollout and serving verification were skipped. Build the frozen
candidate's isolated preview image and packages through the existing trusted
remote workflow; never substitute an older image or claim private Cloud
composition from the Core-only preview. Keep the pin and provisioning default.

Next action: push these narrow corrections, run fresh full CI and review, build
matching immutable preview artifacts in hosted CI, then qualify the one QA tenant
after those gates pass. Retain all historical cost and cleanup holds. The draft
remains neither merge-ready nor production-ready.

At correction `f6a15200c`, fresh review passes 5/5 with all eight threads resolved,
and the previously failing retry E2E shard passes. One unchanged auth-signal
fixture exceeded its 15-second test deadline during a cold route import; its
previous exact version passed on the integrated head. Imports now run in the
existing setup hook after the same resets, keeping the 15-second assertion
deadline and all actor/response checks. All 127 affected auth/form/model cases
pass. A temporary 100ms assertion deadline also passes while setup takes about
six seconds, confirming the separation. Keyboard coverage moved intact into
the existing form suite; the PR stays 99 files. This correction changes only
tests and this record, with the production runtime byte-identical to `f6a15200c`.
Three hosted server shards were interrupted after passing progress and remain
incomplete evidence. The new test-only head requires fresh completed CI.

The frozen `f6a15200c` preview image is building remotely; exact-source shared/DB
preview packages are published and their source metadata verified. The isolated
local preview restarted at `2026-10-09T16:46:58.859Z`, serving that version with
startup recovery ready and no pending migrations. Its existing worktree execution
preference was off; activating it allowed the queued user onboarding response
to run. The actual legacy Codex task completed and its independently read file
contained the exact two requested lines. The same-task follow-up is running.
No second task, agent hire, or automatic runner conversion was used.

Next action: commit and push the narrowed candidate, rerun its checks and fresh
review, then update the PR and existing evidence report. Start the Codex-default
slice after the user chooses to proceed. Merging and deployment remain outside
this task.

### Occupied credential fixture follow-up — 2026-10-12

Current-head `021df207` Runner Vitest 2 failed during fixture preparation with
`EADDRINUSE`, before credential staging. Reused the shared correction from
`50e7554069a31af72069e7632e9ae6151019f449`: prepare a fresh home with two
deliberately occupied candidates, preserve the foreign listener, and retain the
actual staging denial and unchanged auth-file assertion. The three-line code
annotation was removed to follow CONTRIBUTING; its explanation lives here.

Only fixture preparation retries, up to eight fresh homes. It releases only its
owned partial or unselected listeners, then runs credential staging once. A bind
race during that production call remains a visible failure and receives no
retry. No production credential or permission behavior changed.

A controlled occupied-port baseline reproduces the old setup failure. All 42
existing credential controls pass on Node 24 with isolated synthetic data and
zero provider calls or native builds. Comment-only removal preserves the tested
executable structure; the suite was not repeated. Evidence is recorded in
`/private/tmp/ci-final-021df2-shared-credential-quorum-receipt.json` and its
comment-closure receipt. Fresh published-head CI and review remain required.

### 2026-10-13 Published canary and fresh staging qualification

The human merged prerequisite #16028 at actual Core master `d67e3507b23041212fa26302ce6de078c5ebcc05` and asked to cancel the existing timer, then test the published npm canary locally and on a new staging stack. The `finish-runner-default-stack-and-merge` heartbeat was deleted. Codex defaults #15683 remains separate and unmerged. No production or provisioning-default promotion is authorized.

The human approved a separate $25 ceiling: $15 for one owned QA stack/sandbox including pool backfill, $5 for setup and at most four short task/follow-up turns, and $5 for cleanup. Zero automatic retries. The original $248.179254104 held/consumed and all original unknown and cleanup holds remain unchanged. Actual new resource cost is unknown and held within the new reservation.

Ordinary authenticated staging signup created `stack-pool-7998e841ace7` at https://runner-canary-d67-qa-oct-13.staging.paperclip.app. It reached fresh first-agent onboarding with zero agents or provider turns. Its user-managed pin is verified. Initial distribution `cloud-38355190192-1` is old source and has observed schema drift; it is baseline only. Exact d67 signed standard image, source gate and signed migrator have passed. Matching private composition is building through the existing canonical workflow, without a duplicate dispatch.

The public d67 release38389963483 ended successfully but skipped native production, publication and canary onboarding. Registry canary.5 provenance binds it to old4a641d, so local acceptance remains blocked. The focused repair [PR #16149](https://github.com/paperclipai/paperclip/pull/16149), exact `ab99d3f7604cb2ac8d8a45c81276797af834e325`, adds explicit cancellation/source-result guards to the existing producer and canary smoke. Its existing contract cases reproduce two missing guards before treatment. All70 release controls and20 source-verification neighbors pass after treatment; independent source review is clear. All required hosted gates passed with fresh5/5 and actual code-owner approval. PR #16149 merged at `60bc0d5fee9a6e48db08fc016521fee3d9f57d67`; its new master-push release38395574681 is running. Concurrent master changes include Storybook indexing and verification-skill docs; npm and staging source identities remain separate. Source predicate tests support the diagnosis but do not establish actual GitHub scheduling or publication.

The native-runner QA override is applied and converged through one-target feature campaign1791869766576, with zero failed targets. Literal d67 private distribution `cloud:38392212140:1` is qualified. Supported one-target deployment request `f7cb6751-91f8-49a4-9ab8-6092ecb27e7c` passed exact-source/private-artifact preflight38395788220; deployment38395855695 succeeded with authenticated serving verification and `set_default=false`. The pin and current private distribution remain verified.

Attended OpenAI device authorization completed in the embedded browser. Ordinary fresh onboarding created Legacy preservation QA (`f9e30b8e-7ceb-4f88-b373-1a2cba65859d`) with its Codex Legacy configuration and unopened first-task question. Its sandbox and connection settings were retained. Native Codex package QA (`861f95bc-c9fc-4e32-8abb-8829d3fe42de`) was created separately through the explicit experimental runner picker, using Codex, gpt-5.6-luna, the responsible user's saved subscription and Paperclip Computer. This tests the merged prerequisite; automatic Codex defaults remain outside this source.

The native creation Test reported success, but its visible details and exact d67 route show a Legacy Codex ACP/CLI model hello, not native runtime execution. At least one real setup hello is held in the setup reservation separately from the four task-turn allowance; other unmeasured setup usage is not assumed zero. Setup lease `1f2b04ce-97c2-4f81-8f92-0ece0fb54feb` and provider resource `622b8bb6-8bec-40d2-83c2-fa5edddfa6e8` have no independent cleanup confirmation yet. Green setup is not native execution or physical cleanup proof.

Native QA policy survives reload with timeout180 seconds, concurrency1, interval disabled and max-turn continuation disabled. Separate transient/connection retry policy still needs an existing supported control before launching the task. The nonce-bearing first file challenge is drafted, not submitted; task turns remain zero. Existing file-artifact and session-continuity assertions are being reused, with manual adaptations identified rather than relabeled as an unchanged E2E suite pass.

The retry audit found no supported retry-only UI control and no certified provider-start bound: existing native recovery can launch additional continuation prompts. The human explicitly approved normal recovery within the same $25 ceiling, with at most four manual task/follow-up messages, 180-second run timeouts and no automatic test reruns. Production recovery policy is unchanged. One manual staging task was submitted (`9f706825-36db-4950-9179-659406db37fb`); its native execution, file bytes and continuity remain pending. Manual message counts and observed underlying provider/recovery events will be reported separately.

Release38395574681 has now actually completed all four native producers, including Darwin x64 and Linux ARM64, and its canary publisher is active. This supplies hosted scheduling evidence for the release repair. Actual source-bound registry publication and published onboarding smoke remain pending; canary.5 is still excluded as old-source evidence.

Next action: verify the actual staging serving revision, wait for the source-bound published registry package, install the real package in an isolated Apple Silicon consumer, and run real file task/follow-up journeys within the new budget. Preserve the old3125 test-drive and all receipts. Current evidence: `/private/tmp/runner-d67-published-canary-qa/evidence/` and `/private/tmp/ci-artifacts-d67e350-artifact-readiness-receipt.json`. Neither requested live runtime test has passed yet.


#### 2026-10-13 Final published-consumer and fresh-stack result

Actual master release38395574681 completed all four native producers, npm publication and real canary onboarding smoke. Public `paperclipai@2026.1013.0-canary.6` binds to exact60bc, including narrow merged release repair #16149. Its clean isolated Apple Silicon install passed normal lifecycle, all18 no-bundled-Codex tar checks, packaged daemon/provider verification, native startup/open/close and CLI/doctor checks. Official optional npm Codex dependencies are retained; no local Cargo/Rust/Docker/runner-source build occurred. Literal d67 private staging composition and literal60bc npm remain separately attributed.

Ordinary local onboarding completed with the explicitly authorized OpenAI API key saved in a managed connection, and created Legacy preservation QA. The local subscription device flow expired; no subscription was saved. No credential values were written into prompts/reports. Native saved-account setup exposed a real published UI defect: the selected native runtime delegates to Legacy readiness and can trigger a second forced CLI probe, failing `Command not found in PATH: "codex"` despite successful packaged native resolution. Current private #15683 already contains the native setup probe correction, but its artifact/UI has not been tested here. Configure navigation cannot adopt the failed connection; no developer PATH or global Codex workaround was used.

The supported published API created a separate explicit-native local QA agent with the saved responsible-user OpenAI API-key binding. Real UI task [NPM-2](http://127.0.0.1:3136/NPM/issues/NPM-2) completed native runs88eeb636 and4990be3e in43/46seconds. Independent26/52-byte downloads, exact random challenges, negative newline controls, durable attachments and run-attributed work products pass. Same saved account/grant and execution workspace are recorded. A self-added200-cent monthly cap correctly paused after unpriced metered gpt-5.6-luna usage; spent0 is not proof of free use. Removing only that supplemental cap to ordinary budget0 and explicit resume caused a recorded adapter config-revision freshness reset. The second provider session is fresh, so strict same-provider-session continuity fails and is not waived. No pricing or production budget policy was changed.

Fresh staging [RUN-2](https://runner-canary-d67-qa-oct-13.staging.paperclip.app/RUN/issues/RUN-2) completed native runs7d242e7b and a8e62d9c in93/73seconds at d67/cloud:38392212140:1. Independent26/52-byte downloads pass; recorded UI/PRP events show session.started then session.resumed with the same provider session and workspace. Source-bound UI proof is distinct from a direct stored-row/full-grader export, which was unavailable. Its setup green was a Legacy hello and remains excluded as native readiness proof.

Existing local Legacy full execution settings survived native enablement, an unrelated title edit and reload byte-for-byte; that control made zero provider calls. Both native QA agents are paused after four total authorized manual task/follow-up messages, zero test reruns, with normal product recovery unchanged. Local live runs are0. The installed preview remains [3136](http://127.0.0.1:3136/NPM/issues/NPM-2). Historical3125 is stopped, with its original data intact; no current safe staged source-build preflight was available and it was not restarted. Staging remains pinned/user-managed and available for inspection, with no production/default promotion.

The existing exact-source file/artifact graders were reused. Strict registration helper title checks fail because the manual prompts requested readable titles rather than filename-as-title; correct attachment/run attribution passes separately. No metadata was rewritten to manufacture a pass, and no full catalog-cell pass is claimed. Physical cleanup of setup lease1f2b04ce/provider resource622b8bb6 and provider invoices remain independently unconfirmed. The separate25-dollar reservation and original248.179254104 held/consumed ledger preserve all unknown and cleanup holds. Metered model pricing remains unknown/unpriced. Required next gates are corrected native setup artifact qualification, priced-model budget acceptance and authorized physical cleanup confirmation; this does not make the default rollout production-ready.

Detailed receipts and sanitized report: `/private/tmp/runner-d67-published-canary-qa/evidence/`. Public package admission/source receiptc9eeaf…; native consumer receipt45b613…; paid-pair offline integrityb6bb4e…; exact account attribution is a separate six-field projection. These are literal qualification sources, not the unmerged root HEAD1a0ca662. Record-only changes are retained locally for the next actual reconciliation commit; no doc-only CI churn or dependent branch mutation was introduced.

The sanitized report is uploaded and independently download-verified as attachment-backed artifact work product122676da on the unassigned completed operator [NPM-3](http://127.0.0.1:3136/NPM/issues/NPM-3). It does not wake an agent or close the feature gates. Native task artifacts are unchanged. The authorized Claude owner received the prerequisite source/qualification boundaries; no ownership or allowance was reassigned.


#### 2026-10-13 Authorized Codex defaults finish and merge

The human requested that #15683 be finished and merged normally. A separate incremental $100 ceiling and as many bounded messages as needed are explicitly approved. The previous four-message/$25 campaign and original$250 ledger retain all unknown-charge and cleanup holds; they are not refunded or reassigned. Reuse local3136 and owned staging stack7998; preserve their data and receipts. Root owns actual-master reconciliation, exact-head checks/review, ordinary Mac/managed onboarding, checked task/follow-up and normal protected merge. Claude owner retains dependent branches and separate allowance. No production deployment or provisioning-default promotion is authorized. No timer is recreated.

Current-master integration includes `833769ab557255b11dd8f650f43ed7333653f5e4`, then `e3029c632b26b68595adc1a704a387833b3cefcb`. The ordinary merge retains the published Codex history and prerequisite squash history. Its audited logical source delta preserves master fixes, the prepared managed Connect qualification, fresh scoped discovery, and existing first-task eval assertions. The remaining merge conflicts concern Storybook indexes and dated reviews, not execution code. Independent review of both source compositions found no concrete P1/P2 regression; source review does not establish live acceptance.

On the integrated checkout, two focused Codex runs pass 261 tests each across onboarding, runner selection, setup, editing, imports and readiness. Server and UI direct TypeScript checks pass after JavaScript-only shared/DB/adapter-utils/SDK preparation. All token gates pass. New master recovery controls initially report a missing declared trace test dependency and a sandbox-denied PostgreSQL listener; the four unaffected suites pass 74 cases. Isolated installation of the exact declared trace dependencies and an authorized temporary listener allow the two affected suites to pass all 60 cases. No tests are disabled, no lockfile or production policy is changed, and no local native/Docker build occurs. Full canonical workspace checks remain assigned to fresh hosted CI.

Fresh-source remote package qualification, ordinary Apple Silicon onboarding and immutable managed staging onboarding remain pending. The previous canary60bc and stagingd67 receipts stay attributed to those sources. The new budget record reserves resources60/provider30/cleanup10 dollars and retains all prior unknown holds. The supported private Cloud skill and CLI are read from exact private master `4f3a63ad6f3f84c87e0e129da35909d8ccc7ffb0`; a deliberate pre-merge Core preview is separate from actual private Cloud distribution. Freeze the final reviewed product source before building; deploy only the owned pinned QA stack, with `set_default=false`.

Published intermediate448db859 passes the focused source controls and starts fresh hosted checks. A bounded managed-image review then identifies a concrete setup mismatch: real sandbox tasks select provider outer isolation, while `probeNativeRunnerEnvironment` overrides the verified transport choice with false. Correct this internal forwarding and derive its value from the server-resolved target; preserve local/SSH Codex isolation and removal of injected environment flags. The obsolete remote package qualification38423256993 is cancelled to limit costs and is excluded from final proof. Native/Docker work remains remote. Current source and new-head qualification must close the corrected boundary before acceptance or merge.

The maintained Daytona execution image is distinct from a standard Core app image. A saved immutable OCI digest without snapshot/template fields uses normal environment probing, measured OS/architecture/libc, actual image binding and confirmed lease cleanup. The existing full-stack E2E workflow owns its content-addressed execution image and one explicit managed-onboarding cell; its image build and live cell are not yet dispatched. A Core app image cannot be assumed to have compatible Daytona boot behavior merely because it contains the daemon. No provider credential is read to work around this boundary.

The isolation correction changes three production lines, with no API/configuration field or permission change. Inert launch baseline1/8 fails; matching treatment8/8 and23 inert/source neighbors pass. Selected-target server baseline12/12 fails; the full treatment suite51/51 passes, including contradictory configuration/environment flags. Direct server no-emit and independent source review pass. Read-only and approval policy, owner-bound credentials, deadlines and cleanup remain intact. A separately retained overbroad local-listener scaffold failure is not counted as native execution proof.

Intermediate448 hosted CI completes successfully. Fresh review4/5 correctly identifies the new managed case entering a local-only confirmation fixture. Baseline reproduces two failures; scope the existing local fixture correctly, retain all twelve local cases and the thirteenth explicit managed case, and reuse the separate managed-fixture checks. The full existing E2E support run passes2694 controls and exposes two more stale roster assumptions. Update those assertions while retaining the completion judge for accepted managed work and every Pi admission/negative control. No parallel suite or replacement grader is added. Final source still needs fresh published checks/review and live qualification.

Embedded-browser inspection of the built448 stories confirms the dark shared Runner popup and saved Legacy choice. It also exposes remaining OS-native environment/lifecycle/ACP dropdowns on the relevant runtime page. Their narrow shared-picker conversion preserves all values and callbacks and leaves unrelated provider-specific controls alone. These UI changes require a new JavaScript-only Storybook build and rendering checks; the old build remains literal448 evidence. No screenshot baseline is created or changed.

The corrected source passes the full existing E2E support suite:125 files/2697 tests, plus all128 existing Node source/qualification contract controls and direct E2E no-emit. Relevant dropdown baseline145/145 and treatment152/152 pass, including exact save requests for selecting/clearing an environment while retaining Legacy/native execution and accounts. UI no-emit and token gates pass. Independent review of the managed-isolation and confirmation-fixture corrections is clear. These are local source checks; exact-head hosted CI/review, fresh remote packages, rendered stories and real Mac/managed onboarding still remain required. Next action is a single corrected candidate publication, then affected qualification using the existing workflows.

Current published Codex head1a0ca662 is draft with green historical checks. Actual master833769ab is newer than merged prerequisite d67 and release repair60bc. Prepared private onboarding/Storybook work will be reconciled by source, without claiming its private/historical checks as final qualification. Native Connect correction is already in the Codex slice. Final managed defaults require the saved immutable OCI environment probe owned by ordinary Connect. Existing suites/fixtures/assertions/reporting are reused; no duplicate grader or silent Legacy fallback is added. All heavy builds stay remote, Codex payloads remain external official npm dependencies, and saved agents retain runners.

Next action: preserve/commit current evidence, integrate actual master plus reviewed prepared corrections, run targeted checks, freeze/push candidate, require fresh fullCI/review, then qualify ordinary creation/onboarding on Mac and the one staging target before protected squash merge.

The frozen30bc candidate passes all current-head required CI and fresh5/5 review. Its existing remote release-smoke qualification passes all four producers and clean platform consumers. The actual managed onboarding cell38428601763 fails before agent creation: scoped discovery selects native, but Codex0.160 attempts a nested filesystem sandbox while scanning AGENTS.md for the read-only setup session. Both measured setup leases release successfully; the separate fixture environment deletion fails because the fixture leaves it selected as instance default. Preserve this failed attempt, unavailable provider billing and cleanup holds. No task artifact or follow-up is reached.

The correction skips project instruction discovery only in the new empty setup workspace through the supported trusted Codex configuration. It retains the generated security arguments, read-only permission profile, approval-never, no dynamic tools, existing bounded hello turn and teardown deadlines. Ordinary task instruction discovery and saved agent configurations remain unchanged. Pinned official Codex0.160 source confirms the zero instruction limit precedes filesystem probes. Eight inert baseline failures become23 passing source/cleanup neighbors; direct runner/server TypeScript and maps pass. This does not establish hosted treatment.

The existing managed first-task fixture now snapshots and restores its prior instance default and managed-only setting before deletion, including lost setup responses. Unconfirmed default restoration blocks deletion and remains red; other restoration/deletion errors remain inspectable and retry only outstanding cleanup. Three reproduced baseline failures become129 passing first-task controls, with direct E2E TypeScript passing. Independent source review finds no actionable runtime/permission P1/P2; the required source-comment cleanup is applied. Final source needs fresh CI/review, package artifacts and successful ordinary Mac/managed journeys before normal merge. The one owned Core preview deployment for30bc completes through its existing exact-source check/deploy path; actual readiness is independently checked next. No fleet default is changed.

Corrected product source ca31623d36a3d63204077e2e951ff9cdcf2664cf passes all48 ordinary hosted CI jobs, required verify/E2E and fresh5/5 review with26 resolved threads. Its hosted package artifact11834160973 has verified ZIP digest d5d60bf5056f5573461f8d4bd873da78a0204c7f7295d03d5aa7234e55d4af69. The second isolated Mac consumer verifies all18 tarballs, no bundled Codex, official npm Codex0.160, all four daemon bindings and zero-turn native startup/cleanup. Normal install hooks include third-party optional C++ addons; no Paperclip runner/Cargo/Rust/Docker source build occurs locally. The source-bound preview completes one-target deployment38438245490 to the existing pinned QA stack, without default promotion; independent result admission remains separate.

Before paid cell38435063658 entered its matrix job, an admission audit found that ordinary onboarding timeout0 and agent concurrency20 did not satisfy this campaign's retained180-second/single-run bounds. Cancelled the campaign before its live cell started; image/build costs remain unknown and held. Extend the existing first-task fixture with a normal operator configuration PATCH and independent read-back before Get started. Only the timeout/concurrency bounds may change; runner/account/model/environment/permissions remain the wizard's original selection. This is a fixture correction, not a production default or API change. Its first iteration passes149 controls but independent review identifies the concurrency gap. The final combined bound reproduces three functional failures with the previous helper, then passes153 controls and direct E2E TypeScript. Independent review confirms that the timeout reaches the native turn deadline and the queue uses the saved single-run cap; exact source review closes before publication or further live eval admission. No failing or cancelled attempt is relabeled as passed.

The owned local3136 server is updated from30bc to literal ca316 hosted packages after an idle snapshot and stopped-data/home backup. All existing full execution configurations and recorded run projections match before/after, with no provider tasks during upgrade. The fresh Mac company's saved draft resumes with its agent name retained. Ordinary OpenAI API-key Connect creates native Codex with gpt-5.6-sol without a runner override; only the existing QA timeout/concurrency settings are then bounded before Get started. Actual useful task/artifact/follow-up proof is still pending. The staging immutable QA environment is selected temporarily as the instance default, with the prior Paperclip Computer value recorded for restoration. Its normal server credential fallback has not yet been verified. No direct provider-key extraction or production rollout is attempted.

The literal ca316 Mac journey now passes independent exact-file and registration checks for29/63 bytes, saved API-key account binding, native Codex provider session and workspace continuity across all five executed runs. One queued child run is cancelled before start and retained in evidence. Two manual messages and two confirmation responses produce five successful native runs; no process-loss retry occurs. Both task and child finish Done, and the QA agent is paused afterward. Rate-card estimates total$3.504199600, not invoice cost. The existing strict artifact/session helpers are reused offline; this is a real UI journey with independent evidence, not a full catalog-cell pass. Receipt7ef97c4705b085d465eeaf19f11d231e7b01e5a66c61b517cfcde0ec70a2db97 remains literalca316.

Candidate0065 has fresh5/5 review and26 resolved threads but its required E2E gate fails: the unchanged signoff fixture receives a cancelled run while waiting for executor success on GitHub's combined master checkout. The fixture discarded errorCode, so the precise cause is inconclusive. Preserve the failed gate; add only a bounded diagnostic to the existing assertion without weakening ownership, authorization or terminal-state checks. Managed38440601585 fails during image preparation after the hosted runner reports shutdown; its provider pack/live cell are skipped. No named live cell or provider task is admitted. Unknown preparation costs remain held; no automatic retry is dispatched.

Actual master252d9b5077f4eee98ec48225641ef1a02d824158 is integrated through an ordinary merge. Its only conflicts are the three Storybook catalog files. Semantic union preserves226 authored entries,2242 stories, stable IDs, both review histories and actual evidence limits; the existing generator,27 catalog/map controls and structural map checks pass. Runner/Rust/Codex selection/setup/onboarding/guard sources remain byte-identical. Master adds instance-secret storage and migration0339, including its account-home claim check; keep those changes and require fresh combined-source account/lifecycle controls, JS/DB installation, CI/review and current-source managed acceptance. Prior receipts retain their original revision.

On the owned staging stack, ordinary environment Test connects to the immutable image but cannot confirm probe-lease cleanup. New-agent discovery remains Legacy; the supported onboarding entry surfaces the exact pending-cleanup error before hiring. This is a blocked managed acceptance, not a native pass or a silent runner conversion. The QA environment had autoDeleteInterval0; source ordering makes immediate deletion after stop before archival a plausible cause, not a proven provider diagnosis. Attempting to change its QA interval to60 is correctly rejected while cleanup is pending, so persisted configuration remains0. Preserve the failed lease, its holds and the guard; do not clear durable state or extract provider credentials to manufacture qualification. Next action is confirmed owned-resource cleanup, then qualification of corrected QA configuration and normal native setup/task/follow-up.

Combined-source integration passes100 existing controls with the repository launcher's canonical isolated HOME/config/TMPDIR contract:41 device-login,12 real-PostgreSQL instance-secret and47 lifecycle tests, zero skips. Initial direct-invocation99/100 and alone identity-verdict failures remain recorded; no expectations or product code were changed. No on-disk worktree config write is observed, and3136 uses a separate preserved home/data. Direct server/E2E TypeScript pass. The existing signoff failure assertion now retains only a bounded verified errorCode; ownership, issue checks, deadlines, retry semantics and terminal failures stay intact. Actual-helper baseline12-pass/4-missing-diagnostic failures become16 passing inert controls, with no browser/provider work. This improves subsequent diagnosis and does not claim to repair the earlier cancellation.


The integrated6c candidate now passes all48 ordinary hosted jobs, required verify/E2E and fresh Greptile5/5 with26 resolved threads. The earlier signoff case passes on this combined source; its earlier0065 cancellation remains an inconclusive historical failure, not a proved flake. The remote four-platform/package qualification38445419339 binds literal6c. A single guarded managed onboarding cell38448001365 also resolves literal6c through the trusted master workflow and independently verified target lock; its exact selection and180-second/concurrency1 guard pass admission. No second paid cell or automatic test rerun is dispatched.

Master advances once more to c8efdbfba43377d39f57e4822e92d796a8a044b6 through Storybook-only #16196. Its only conflicts are the same three catalog files. Semantic reconciliation preserves all226 candidate suites and37 new master suites,263 suites/2499 stories, stable IDs and both review histories. Existing27 catalog/generator controls and35-area/175-ID map checks pass. Independent virtual-merge and actual staged checks prove every production/native/package/build component remains byte-identical to6c. Keep the6c package/image/live receipts literal; this catalog-only merge requires fresh head CI/review and applicable Storybook checks, not another expensive native build or paid runtime campaign.

The supported Cloud CLI is re-read from current private master8472ece87f8d9a9e17a6116b9f4631d98ce63486 and is byte-identical to the previously used maintained command. Its one-target preview request d227da49-fd73-44c0-9377-f25711e529bc builds literal6c remotely in38448052890, preserving the existing pinned/user-managed QA stack and leaving fleet/default promotion disabled. Build, deployment and actual serving-source verification remain pending. A separate QA environment with the same immutable execution image and autoDeleteInterval60 is saved through ordinary UI, with instance default unchanged and no probe yet. The prior failed environment, durable teardown record and cost holds remain intact. It cannot borrow the older environment's qualification facts; it needs its own new saved probe and confirmed matching cleanup before automatic native onboarding.

Existing ordinary board lease APIs and CLI diagnostics are identified, but anonymous challenge creation and the installed CLI's existing board context both receive401 at this tenant's public edge. No browser/provider credential is extracted and no new inspection API/workflow is introduced. The plugin settings route correctly honors Cloud's hidden-settings gate. Existing Fleet Admin provider links reach the normal signed-in Railway log UI; two successful aggregate orphan-cleanup sweeps prove the controller operates, but neither receipt binds the exact outstanding probe lease. Preserve that uncertainty and its hold. Current-source installed JS/DB migration/account preservation, independent managed task/follow-up and normal protected merge remain the next gates. No timer or production deployment is started.


#### 2026-10-14 Codex qualification and new Test environment reconciliation

Frozen product9546f41e964953c801ad8c2d8bdecadbd5cd3830 passes current-source required CI and fresh5/5 review with30 resolved threads. Its existing four-platform/package campaign38485482843 succeeds: all18 tarballs/four daemon manifests, normal isolated Apple Silicon install, native credential-free startup/open/close and fresh installed DB initialization through0343 are independently verified. This source-built qualification package is not a registry-published npm canary. No Codex payload is bundled, and no local Cargo/Rust/Docker/native source build occurs.

The original managed onboarding case38485488621 passes its19 assertions and completed judge, without retry. Four actual native turns execute the child-bound240-byte file and real completion callback/reply with parent session/workspace continuity. Its checkout reports dirty state: the verified generated target lock replaces the committed lock, but full final porcelain is unavailable. Literal HEAD, runtime/assets and effective graph are verified separately. The reused signed execution image keeps its historical producer identity. Guarded environment removal and server shutdown pass; physical deletion and invoices are not certified. Earlier failed attempts and unconfirmed cleanup holds remain intact. Public evidence: https://d1p6rlowie26tp.cloudfront.net/runner-e2e/campaigns/gha-38485488621-1/index.html.

Ordinary fresh9546 Mac onboarding persists native Codex without a runner override before any QA bounds. The first useful document task and actual Done-parent completion callback execute successfully. One human follow-up updates the same child document to revision2 and publishes a child-bound1,101-byte file. Independent API and real browser downloads match SHA256b758f6d23b33cfa9cfc597a4c3bc2abbf74dc56b7b5d2b30fc45f65c1a4d1905. All seven actual native runs succeed; parent sessions/workspace continue, child execution has its own task session, observed concurrency1, longest run under47seconds, reload preserved. Two recovered proposal-format errors remain a nonblocking quality follow-up.

Existing installed Mac upgrade preserves all three execution configurations, safe account summaries and eight historical recorded run profiles. The existing Legacy agent's ordinary title edit/reload keeps execution settings, and its shared Advanced dropdown retains Legacy. Two actual Legacy/direct-adapter runs complete the same task and independently checked15-byte then34-byte files. Prior session state is passed and workspace continues; returned provider UUID changes, so stable provider-ID continuity is not claimed. After explicit human authorization, the root-created company QA guard is restored to its original0 and a500-cent hard stop is scoped to the selected Legacy agent. Historical unpriced costs/holds remain unchanged, normal service resolves only the new QA incident, other agents remain paused, and the company is paused again after all runs finish. Rate-card estimates: Mac3.4154336, managed1.170946, Legacy0.114767 dollars; none is an invoice. The separate100-dollar ceiling and all original250/25-dollar unknown/cleanup holds remain enforced.

The human selected the actual new Test environment for pre-merge acceptance. Its deployed policy supports verified branch previews, unlike Staging's current master-ancestry restriction. Normal Test email-code sign-in has sent a code and awaits the human handoff; no OTP redaction workaround, session impersonation or credential extraction is used. No actual owned Test tenant, schema admission, deployment or live task is claimed yet. The maintained one-target CLI and deliberately core-only preview path are prepared, with existing snapshot/migration-role/health/lock protections and set_default=false. Private Cloud composition and production/default promotion remain separate post-merge gates. The human also authorized a code-owner-review exception for PR15683 only, after all current-head CI/review/live gates pass; no global repository rule is changed and no other PR's approval is waived.

Remote preview38498802456 completes at exact9546, through trusted workflow definitionb8ffeb973a2a1d430efabffd755f15b6c7cf112a. The ready result matches its single request; immutable Core image digest4cba5c3546c3af3b948f0ee9c3532ada7c754491ce2d175a00164adc46698976 and exact9546 DB/shared registry archives match producer bytes/integrities. This Core preview has no standard signed-image attestation; npm SLSA structure is source/invocation-bound but cryptographic verification is not claimed. The signed execution image is a distinct artifact. No image layers or large transfer archive are downloaded locally. Terminal admission receipt: /private/tmp/current-9546-preview-preparation/TERMINAL-PREVIEW-PAIR-QUALIFICATION.json, SHA25692faae84c89e9e37e23129b6a5cd18580ed1c09517db91286afdf1445e3b5c6f.

Before merge, actual master advances to875943ac83e730fd4cfbe1e1860b3f4d7bf0ac78 and GitHub reports five content conflicts. Ordinary reconciliation preserves the Codex shared exports, flag-free Codex runtime, unified harness picker/display and incoming Grok Bot exports, three-flag admission, dedicated connection and Execution/Usage summary. The shared display helper additionally preserves Grok Bot branding; it must not label that existing external provider as Paperclip Runner. Seven narrow controls extend the existing display, mounted configuration and runtime-selection suites. An initial new test expected a saved connection section from an unsaved fixture; it is corrected to the existing save-first guidance without changing production behavior. Required maps now align35areas/176 capability IDs and direct token gates pass. Incoming shared Rust/backend/protocol bytes and migration0344 are materially different:9546 artifacts/live proof remain literal, and final integrated native/package/DB qualification must be refreshed remotely. No evidence is relabeled as combined-source proof.

The resolved composition passes226 cases across the five existing runtime/display/mounted/selection/heartbeat suites. Direct server and UI no-emit checks pass after JavaScript-only Runner SDK declaration preparation and isolated installation of the exact declared Speko0.0.13 dependency with lifecycle scripts disabled. Initial missing-dependency/stale-declaration diagnostics remain setup limitations; no production workaround or dependency/lockfile change is made. All three existing token checks and staged diff checks pass. Fresh hosted full checks/review and remote native/package qualification remain required.

Current inspectable QA results remain on local3136/3137 with preserved data. The normal board context publishes the sanitized qualification checklist as an attachment-backed primary work product on NPM-3; Done/unassigned status remains and no agent is woken. Canonical PR: https://github.com/paperclipai/paperclip/pull/15683; branch codex/codex-runner-default. Test login/owned target, refreshed reconciled-head gates/artifacts and real Test onboarding/task/file/manual follow-up remain the next action. No timer, merge, production deployment or provisioning-default promotion is performed in this checkpoint.

#### 2026-10-14 current Test deployment and native cleanup failure

Exact published651a passes fresh current-head CI/review and the remote four-platform/package campaign38502151368. Its normal installed Apple Silicon startup, fresh343-migration initialization through0344 and upgrade preservation pass; earlier9546 live evidence remains literal. The immutable preview38503641696 and matching DB/shared bytes pass independent admission. No Codex payload is bundled and no local Docker/Cargo/Rust build occurs.

The human completes customer and separate Fleet Admin sign-in. One fresh customer-owned Test workspace is cold-provisioned, pinned through normal Admin UI and verified after reload. The maintained one-target core-only prepare/deploy succeeds with exact651a app/schema and authenticated serving-source verification, preserving the pin and fleet default. This unsigned branch preview is not the post-merge private Cloud distribution. Its execution image retains the distinct historical signed producer ea6c.

One ordinary Dashboard first-agent Auto Codex API-key Connect records account connection and environment probing on the saved immutable QA target. Native setup then fails before hire: runtime closing exhausts the existing10-second cleanup deadline and authority release remains unconfirmed. The failed payload is delivered after110573ms; HTTP200 is not readiness. No agent, task, follow-up, Legacy switch or unchanged retry occurs. Hello usage, physical cleanup and invoices remain unverified and held. The failure receipt is SHA2561bfce873af81f2424d9ca66dfd64404a21f19e386c3b51e2e0e08cb3f6e37be3. Actual Test acceptance blocks merge despite the scoped code-owner exception.

Read-only forensics reproduces two relevant bounded-close defects through the existing suites: a remote durable-state read can exceed its remaining suspension deadline, and an authenticated WebSocket awaiting peer close acknowledgement can outlive the setup budget. Late suspension proof is already rejected, and authority is retained; the repairs must preserve those protections and require actual physical socket closure before release. These reproductions establish source defects, not the sole cause of the live failure. The retained controller projection and provider request logs contain only permitted metadata; credentials, prompts and provider keys are not extracted.

Next action: complete narrow deadline/physical-close repairs and independent review, retain baseline failures, freeze a new candidate with fresh applicable gates/artifacts, recover only confirmed owned cleanup, and repeat changed-source Test automatic setup/task/checked file/manual follow-up. Then merge the exact ready head under the human's scoped exception and discover/wait for actual npm publication, signed standard image, migrator and private Cloud composition. Production deployment/default promotion remain outside authorization. The original timer stays cancelled and all prior unknown-charge/cleanup holds remain intact.

The narrow repairs now pass source controls and independent review. Four delayed-state baseline failures become15 passing deadline/containment/authority controls, with direct runner runtime TypeScript passing. Ingress's original no-acknowledgement regression fails before repair; a second review reproduces an earlier-error socket escaping active ownership. Final12 controls pass after retaining every owned socket until its physical close, with direct server TypeScript passing. Missing physical-close evidence remains blocked, and the original10-second setup deadline is unchanged. Maps35areas/176IDs and diff checks pass. These JavaScript repairs change neither permission policy nor native Rust; new-head hosted gates and actual Test treatment remain required.

The actual retained Test controller records turn.accepted/started/completed and completed drain/suspend commands. Their stored timestamps are command issuance times, not completion times, so they cannot identify which close stage exhausted the deadline. The internal setup identity differs from the public environment lease; their correlation remains contextual. No hello content, provider invoice or physical deletion is inferred. The local3136 evidence viewer is restored through normal installed651a startup after a current DB-only read-only idle/paused check. All three agent configurations/accounts and ten recorded run identities match its previous651a snapshot. The refreshed primary NPM-3 report is independently downloaded and hash-verified, preserving Done/unassigned status and historical cleanup state. Local3137 and all prior evidence stay unchanged.